topic Re: Splunk show duplicate event but there is only one in Splunk Search

Splunk show duplicate event but there is only one

darismendy — Fri, 27 Apr 2018 14:16:20 GMT

Hello

I'm monitoring a directory with splunk when i search for those events it shows me by example the field id with count =2

but if i search for that id it shows me only one event , why is this happening?

Re: Splunk show duplicate event but there is only one

FrankVl — Fri, 27 Apr 2018 14:24:25 GMT

Can you share both the searches (ideally screenshots that show the search query, as well as the (relevant part of) the results?

Re: Splunk show duplicate event but there is only one

mdsnmss — Fri, 27 Apr 2018 14:40:20 GMT

If your data is coming in JSON or some other structured format and you are having fields extracted at index time then you do not need them done at search time. That is likely what is occuring here. On the search head where this is occuring set KV_MODE = none for the sourcetype that this data is in. Then it should only be extracted at index time and not at search time as well.

Re: Splunk show duplicate event but there is only one

somesoni2 — Fri, 27 Apr 2018 14:57:32 GMT

Also make sure that, the time range of both searches are exactly same.

Re: Splunk show duplicate event but there is only one

darismendy — Fri, 27 Apr 2018 15:07:27 GMT

Hello thank you for our answer, I'm not making extractions at index time, i'm just only not truncating the incoming data