HTTP input sending duplicate events?

snisaxena — Fri, 21 Oct 2022 14:28:29 GMT

I have configured HTTP inputs by creating HEC token in heavy forwarder.

I see duplicate events every time I test sending data via these HEC token. I have validated that source does not have duplicate events.

Even if I send a test event using curl command, it appears twice.

curl -k https://<endpoint>:8088/services/collector/event -H "Authorization: Splunk <HEC token>” -d '{"event": "This is a test event"}'

Please help find out why are there duplicate events and how can I fix it.

topic HTTP input sending duplicate events? in Getting Data In