https://community.splunk.com/t5/Splunk-ITSI/Multiple-event-id-is-created-in-itsi-tracked-alerts-from/m-p/387750#M673 <UL> <LI><P>Is your search returning more than 1 event when it runs ?<BR /> If it does, maybe massage your events, like using a "|dedup " or "| head 1" to trim them before the notables are created.</P></LI> <LI><P>If your events results are unique but get indexed twice<BR /> check the _indextime of the notable events, to figure when they were created.<BR /> Check if you have a useack=true enable in the outputs.conf of your search-head (it can cause the forwarder to attempt to send the same events multiple time in case of network failure)<BR /> check if you are not cloning your data to 2 sets of indexers</P></LI> </UL> Thu, 24 Oct 2019 23:00:40 GMT yannK 2019-10-24T23:00:40Z https://community.splunk.com/t5/Splunk-ITSI/Multiple-event-id-is-created-in-itsi-tracked-alerts-from/m-p/387749#M672 <P>Need help in understanding Notable event, I am using correlation search to create Notable event, where my search has “time_range and schedule as 5min” which return single result(ie single event)</P> <P>However I am able to see 2 event_id within itsi_tracked_alerts index for same search thus resulting into Notable event count 2 in Episode review in ITSI.</P> <P>index=itsi_tracked_alerts sourcetype="itsi_notable:event" project=”abc” :- 2 event with 2 different event_id.</P> <P>Correlation serach:---- generates only 1 event.</P> <P>I am not sure why 2 event are created in “itsi_tracked_alerts” for project “abc”. Where according to correlation serach it should only generate 1 event id. </P> <P>Please help</P> Wed, 30 Sep 2020 00:40:49 GMT https://community.splunk.com/t5/Splunk-ITSI/Multiple-event-id-is-created-in-itsi-tracked-alerts-from/m-p/387749#M672 bpratap 2020-09-30T00:40:49Z https://community.splunk.com/t5/Splunk-ITSI/Multiple-event-id-is-created-in-itsi-tracked-alerts-from/m-p/387750#M673 <UL> <LI><P>Is your search returning more than 1 event when it runs ?<BR /> If it does, maybe massage your events, like using a "|dedup " or "| head 1" to trim them before the notables are created.</P></LI> <LI><P>If your events results are unique but get indexed twice<BR /> check the _indextime of the notable events, to figure when they were created.<BR /> Check if you have a useack=true enable in the outputs.conf of your search-head (it can cause the forwarder to attempt to send the same events multiple time in case of network failure)<BR /> check if you are not cloning your data to 2 sets of indexers</P></LI> </UL> Thu, 24 Oct 2019 23:00:40 GMT https://community.splunk.com/t5/Splunk-ITSI/Multiple-event-id-is-created-in-itsi-tracked-alerts-from/m-p/387750#M673 yannK 2019-10-24T23:00:40Z