https://community.splunk.com/t5/Getting-Data-In/Will-Splunk-ingest-the-same-data-if-it-is-sent-to-two-different/m-p/501797#M85499 <P>I currently see the wineventlog:security as a source under my wineventlog index for the Splunk_TA_Windows app <BR /> and also under my main index. </P> <P>Is it possible I am indexing this data twice? <BR /> Will Splunk ingest the same data if it is sent to two different indexes? </P> Wed, 30 Sep 2020 02:32:30 GMT eellingson 2020-09-30T02:32:30Z https://community.splunk.com/t5/Getting-Data-In/Will-Splunk-ingest-the-same-data-if-it-is-sent-to-two-different/m-p/501797#M85499 <P>I currently see the wineventlog:security as a source under my wineventlog index for the Splunk_TA_Windows app <BR /> and also under my main index. </P> <P>Is it possible I am indexing this data twice? <BR /> Will Splunk ingest the same data if it is sent to two different indexes? </P> Wed, 30 Sep 2020 02:32:30 GMT https://community.splunk.com/t5/Getting-Data-In/Will-Splunk-ingest-the-same-data-if-it-is-sent-to-two-different/m-p/501797#M85499 eellingson 2020-09-30T02:32:30Z https://community.splunk.com/t5/Getting-Data-In/Will-Splunk-ingest-the-same-data-if-it-is-sent-to-two-different/m-p/501798#M85500 <P>It is highly unlikely. Figure out what <CODE>host</CODE> is sending, go to that host, and do this:</P> <PRE><CODE>$SPLUNK_HOME btool list inputs --debug </CODE></PRE> Mon, 14 Oct 2019 22:54:21 GMT https://community.splunk.com/t5/Getting-Data-In/Will-Splunk-ingest-the-same-data-if-it-is-sent-to-two-different/m-p/501798#M85500 woodcock 2019-10-14T22:54:21Z