https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203576#M40214 <P>I have the same problem and my version is Splunk Enterprise 6.5.3. Do you have an issue?</P> Wed, 21 Jun 2017 15:37:26 GMT erwan_raulet 2017-06-21T15:37:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203571#M40209 <P>Hi Splunkers,</P> <P>I have noticed an issue in my Splunk environment:</P> <P>Issue:</P> <P>Data is getting duplicated twice in indexers. If i do a search in search head, the same events are coming in twice. this issue started 2 days ago, earlier there is no issue with the data.</P> <P>My Investigations:</P> <P>1)checked the application logs wether same log is existing twice? Answer: No<BR /> 2)Checked whether this issue is happening to one sourcetype OR only for one index OR one forwarder? Answer: No it is affecting all forwarders and indexers data.</P> <P>My questions:</P> <UL> <LI>Is the issue is from the Indexer cluster side?</LI> <LI>Is the issue is from the forwarder side?</LI> <LI>Or any other reason why it is happening? and what are the steps need to prevent it? </LI> </UL> <P>Thanks in advance.</P> <P>Regards,<BR /> Reddy.</P> Wed, 02 Nov 2016 20:23:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203571#M40209 mpreddy 2016-11-02T20:23:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203572#M40210 <P>Something changed in your configuration. Did someone change outputs.conf. on the forwarders?<BR /> If no one changed the source data files, then someone must have changed a Splunk setting in some .conf file</P> Wed, 02 Nov 2016 23:32:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203572#M40210 lguinn2 2016-11-02T23:32:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203573#M40211 <P>@lguinn</P> <P>We did not touched any config files in forwarders.</P> Wed, 02 Nov 2016 23:35:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203573#M40211 mpreddy 2016-11-02T23:35:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203574#M40212 <P>are the duplicate events coming from the same bucket or different buckets? you can isolate one of the duplicate events, and then check with bucket+splunk_server the event and its duplicates are being returned from</P> <P>"some_dup_event | eval bkt=_bkt | fields + bkt,splunk_server"</P> Tue, 29 Sep 2020 11:38:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203574#M40212 dxu_splunk 2020-09-29T11:38:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203575#M40213 <P>Seems like an issue from 6.3.x upgrade to newer version after 6.4.x would fix the issue. </P> Thu, 02 Feb 2017 00:00:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203575#M40213 vasanthmss 2017-02-02T00:00:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203576#M40214 <P>I have the same problem and my version is Splunk Enterprise 6.5.3. Do you have an issue?</P> Wed, 21 Jun 2017 15:37:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203576#M40214 erwan_raulet 2017-06-21T15:37:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203577#M40215 <P>I have same issue my data is getting doubled in indexers each time a log is captured </P> Mon, 20 Jan 2020 13:28:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-when-data-getting-duplicated-twice-in-indexers/m-p/203577#M40215 sreekarnapu1109 2020-01-20T13:28:23Z