topic Re: repeatative of splunk web messages after deleting in Splunk ITSI

repeatative of splunk web messages after deleting

DataOrg — Thu, 06 Jun 2019 07:19:59 GMT

I am using ITSI enterprise and i am getting web messages after deleting also.
the messages is also not current messages which is older messages.

Re: repeatative of splunk web messages after deleting

VatsalJagani — Thu, 06 Jun 2019 10:32:13 GMT

Can you tell what messages are those?

Re: repeatative of splunk web messages after deleting

DataOrg — Thu, 06 Jun 2019 12:09:25 GMT

1.Duplicate entity aliases found. This may cause incorrect statistical aggregation results for KPI base searches. Show duplicates.
2.Duplicate entity aliases found. This may cause incorrect statistical aggregation results for KPI base searches. Show duplicates.
3.Duplicate entity aliases found. This may cause incorrect statistical aggregation results for KPI base searches. Show duplicates.
4.Duplicate entity aliases found. This may cause incorrect statistical aggregation results for KPI base searches. Show duplicates.

with older dates and time
every day messages count increasing

Re: repeatative of splunk web messages after deleting

DavidHourani — Thu, 06 Jun 2019 12:18:51 GMT

what are the duplicates ? Show duplicates.

Re: repeatative of splunk web messages after deleting

VatsalJagani — Thu, 06 Jun 2019 12:23:09 GMT

@premranjithj,

You are getting "Duplicate entity aliases found" message, which means some entities has same alias. It is showing messages with old timestamp as this message generated when ITSI first time found entity alias which has already available in same Service. But those entities is still exist and same issue is available so it is showing messages with old timestamp.

Hope this helps!!

Re: repeatative of splunk web messages after deleting

DataOrg — Fri, 07 Jun 2019 06:42:51 GMT

i have deleted the entities which causing this alert but it getting created on the next day. i have not restore it