topic Duplicate Results on Command-Line Query vice No Duplicates via UI in Splunk Search

Duplicate Results on Command-Line Query vice No Duplicates via UI

joemcmahon — Wed, 25 Sep 2024 20:39:52 GMT

What would cause a command line query ( bin/splunk search "..." ) to return duplicate results over what the UI would return?

Re: Duplicate Results on Command-Line Query vice No Duplicates via UI

ITWhisperer — Wed, 25 Sep 2024 20:51:04 GMT

Please explain what you mean by "duplicate" results, and what is your search, does this happen for just one search or all searches, does it happen for all timeframes or just certain ones?

Re: Duplicate Results on Command-Line Query vice No Duplicates via UI

joemcmahon — Thu, 26 Sep 2024 01:06:58 GMT

Simple query, actually.

index=ourindex earliest=epoch1 latest=epoch2

Command line query returns 16 events, same query in UI returns 8 events. The 16 events have 8 duplicates.

Running 9.1.1 Splunk Enterprise. Search head cluster.

Re: Duplicate Results on Command-Line Query vice No Duplicates via UI

ITWhisperer — Thu, 26 Sep 2024 07:27:36 GMT

Do you get the same results when running the command line on all nodes in the cluster? How many nodes do you have?

Re: Duplicate Results on Command-Line Query vice No Duplicates via UI

joemcmahon — Thu, 26 Sep 2024 13:28:10 GMT

We have a 4 search head (SH) cluster.

I just found that, when running the command line query from each SH in the cluster, it gives me the right number of events.

When running that same command line query from a standalone SH, I get the duplicate results. For example, from the Monitoring Console SH, the command line query gives me the duplicate results.

Same search peers in both cases.