topic Re: Getting duplicate events in splunk-ITSI indexes. in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Getting-duplicate-events-in-splunk-ITSI-indexes/m-p/516011#M87353 <P>Both SH and Indexer cluster is there. I have configured Splunk -ITSI with servicenow , after configuring we found that duplicate events are coming in itsi_tracked_alerts and itsi_grouped_alerts indexes</P> Tue, 25 Aug 2020 12:41:12 GMT sag5757 2020-08-25T12:41:12Z Getting duplicate events in splunk-ITSI indexes. https://community.splunk.com/t5/Getting-Data-In/Getting-duplicate-events-in-splunk-ITSI-indexes/m-p/515982#M87349 <P>I have a clustered enviroment. But still getting duplicate events in splunk -ITSI indexes. Please give some recommendation .&nbsp;</P> Tue, 25 Aug 2020 10:23:52 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-duplicate-events-in-splunk-ITSI-indexes/m-p/515982#M87349 sag5757 2020-08-25T10:23:52Z Re: Getting duplicate events in splunk-ITSI indexes. https://community.splunk.com/t5/Getting-Data-In/Getting-duplicate-events-in-splunk-ITSI-indexes/m-p/516009#M87352 My recommendation is to better describe the problem and the Splunk environment.<BR />Is the cluster an indexer or SH cluster? Which events are duplicated, all or some? How are the events ingested? Tue, 25 Aug 2020 12:37:33 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-duplicate-events-in-splunk-ITSI-indexes/m-p/516009#M87352 richgalloway 2020-08-25T12:37:33Z Re: Getting duplicate events in splunk-ITSI indexes. https://community.splunk.com/t5/Getting-Data-In/Getting-duplicate-events-in-splunk-ITSI-indexes/m-p/516011#M87353 <P>Both SH and Indexer cluster is there. I have configured Splunk -ITSI with servicenow , after configuring we found that duplicate events are coming in itsi_tracked_alerts and itsi_grouped_alerts indexes</P> Tue, 25 Aug 2020 12:41:12 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-duplicate-events-in-splunk-ITSI-indexes/m-p/516011#M87353 sag5757 2020-08-25T12:41:12Z Re: Getting duplicate events in splunk-ITSI indexes. https://community.splunk.com/t5/Getting-Data-In/Getting-duplicate-events-in-splunk-ITSI-indexes/m-p/516028#M87354 <P>How is the ServiceNow data getting in to Splunk?&nbsp; I suspect inputs are running in more than one location, which is causing the duplicate data.</P> Tue, 25 Aug 2020 13:52:34 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-duplicate-events-in-splunk-ITSI-indexes/m-p/516028#M87354 richgalloway 2020-08-25T13:52:34Z