https://community.splunk.com/t5/Getting-Data-In/How-to-deal-with-data-that-was-uploaded-twice/m-p/365976#M66604 <P>You can use <CODE>delete</CODE> command to remove those duplicate records from any future search (it actually makes those records unsearchable but doesn't actually deletes it/removes from disk). See this for more information on the same.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/RemovedatafromSplunk#Delete_events_from_subsequent_searches">https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/RemovedatafromSplunk#Delete_events_from_subsequent_searches</A></P> <P>Please ensure that you run the search without delete command first and validate that you got only the records that you want to delete.</P> Wed, 04 Oct 2017 14:19:20 GMT somesoni2 2017-10-04T14:19:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-deal-with-data-that-was-uploaded-twice/m-p/365974#M66602 <P>Hi Experts,</P> <P>I am now in a strange situation, we have a index in which we uploaded .csv files for every month and for previous month data has been uploaded two times. now splunk is showing duplicate entries.</P> <P>Can someone please suggest how can I get through this situation?<BR /> I want to remove duplicate entries for last month from index. </P> <P>Thanks.</P> <P>Regards,<BR /> Sud</P> Wed, 04 Oct 2017 14:08:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-deal-with-data-that-was-uploaded-twice/m-p/365974#M66602 sudarshan391 2017-10-04T14:08:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-deal-with-data-that-was-uploaded-twice/m-p/365975#M66603 <P>Check out this link:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete</A></P> Wed, 04 Oct 2017 14:16:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-deal-with-data-that-was-uploaded-twice/m-p/365975#M66603 prosenjit2707 2017-10-04T14:16:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-deal-with-data-that-was-uploaded-twice/m-p/365976#M66604 <P>You can use <CODE>delete</CODE> command to remove those duplicate records from any future search (it actually makes those records unsearchable but doesn't actually deletes it/removes from disk). See this for more information on the same.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/RemovedatafromSplunk#Delete_events_from_subsequent_searches">https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/RemovedatafromSplunk#Delete_events_from_subsequent_searches</A></P> <P>Please ensure that you run the search without delete command first and validate that you got only the records that you want to delete.</P> Wed, 04 Oct 2017 14:19:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-deal-with-data-that-was-uploaded-twice/m-p/365976#M66604 somesoni2 2017-10-04T14:19:20Z