I'm getting duplicate events from files within a monitored folder. The splunkd.log has the following repeating entries:
05-30-2016 16:30:02.297 +1000 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/pvlogs/QUT-GP-P10/int_magnetek_160530.txt'.
05-30-2016 16:30:02.303 +1000 INFO WatchedFile - Will begin reading at offset=24068 for file='/opt/pvlogs/QUT-GP-Y11/int_magnetek_160530.txt'.
05-30-2016 16:30:02.306 +1000 INFO WatchedFile - Resetting fd to re-extract header.
05-30-2016 16:30:03.298 +1000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/pvlogs/QUT-GP-P-SolarTrees/int_sma_160530.txt'.
05-30-2016 16:30:03.298 +1000 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/pvlogs/QUT-GP-P-SolarTrees/int_sma_160530.txt'.
05-30-2016 16:30:08.307 +1000 INFO WatchedFile - Resetting fd to re-extract header.
05-30-2016 16:30:09.311 +1000 INFO WatchedFile - Resetting fd to re-extract header.
**Splunk Versions:**
Splunk universal forwarder 6.3.0
Splunk indexer 6.3.3
The data file is approximately 51K in size.. and the forwarder has ingested all of the lines within the file in question.. except there are masses of duplicate events for each line.
**inputs.conf**
[monitor:///opt/pvlogs/QUT-GP-P-SolarTrees/*.txt]
disabled = false
index = test
sourcetype = sec_pv_data
host = QUT-GP-P-SolarTrees
crcSalt =
**props.conf**
[sec_pv_data]
SHOULD_LINEMERGE=false
HEADER_FIELD_LINE_NUMBER=5
HEADER_FIELD_DELIMITER=;
SEDCMD-null=s/\[Start\]|\[info\]|\[messung\]|Anlage.*|Datum.*|Info.*|;Time.*|;s;.*//
FIELD_DELIMITER=;
Is anyone able to give me some insight into what might be happening here?
Thanks!