topic How to troubleshoot why we are seeing duplicate data when running a search in our indexer clustering environment? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-we-are-seeing-duplicate-data-when/m-p/112288#M23503 <P>Duplicate data.</P> <P>I am noticing that we are getting 4 identical lines occurring when i issue a search from a search head.</P> <P>This is using an indexer cluster (4 nodes, 2 at each Data Center) and forwarders that are configured to use native loadbalancing, along these lines: </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Aboutclusters">http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Aboutclusters</A></P> <P>Would the expectation with such a cluster just be one line per logfile entry? Have we done something wrong? Is the duplication more likely to be the index cluster or the forwarders - is there a way to determine ?</P> Tue, 31 Mar 2015 01:40:28 GMT greenwayb 2015-03-31T01:40:28Z How to troubleshoot why we are seeing duplicate data when running a search in our indexer clustering environment? https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-we-are-seeing-duplicate-data-when/m-p/112288#M23503 <P>Duplicate data.</P> <P>I am noticing that we are getting 4 identical lines occurring when i issue a search from a search head.</P> <P>This is using an indexer cluster (4 nodes, 2 at each Data Center) and forwarders that are configured to use native loadbalancing, along these lines: </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Aboutclusters">http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Aboutclusters</A></P> <P>Would the expectation with such a cluster just be one line per logfile entry? Have we done something wrong? Is the duplication more likely to be the index cluster or the forwarders - is there a way to determine ?</P> Tue, 31 Mar 2015 01:40:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-we-are-seeing-duplicate-data-when/m-p/112288#M23503 greenwayb 2015-03-31T01:40:28Z Re: How to troubleshoot why we are seeing duplicate data when running a search in our indexer clustering environment? https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-we-are-seeing-duplicate-data-when/m-p/112289#M23504 <P>So what was the final outcome? Did you end up figuring out the root cause?</P> Tue, 31 Jan 2017 21:47:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-we-are-seeing-duplicate-data-when/m-p/112289#M23504 jagadeeshm 2017-01-31T21:47:54Z Re: How to troubleshoot why we are seeing duplicate data when running a search in our indexer clustering environment? https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-we-are-seeing-duplicate-data-when/m-p/112290#M23505 <P>by any chance were you using useAck? </P> Fri, 01 Sep 2017 13:20:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-we-are-seeing-duplicate-data-when/m-p/112290#M23505 gduggan1 2017-09-01T13:20:07Z