Why am I receiving alert mail twice?

[JGP]

We have recently upgraded our Splunk cluster to 9.0.1 and one of the application team has highlighted that they are receiving alert mail twice for the same alert with same results in both alert mail. 

Alert condition is every 2hrs 

what could the reason behind it?

[gcusello]

Hi @JGP,

I suppose that you're speaking of a Search Head Cluster, check if there are two alerts that generate email, you can see using this simple search.

| rest /servicesNS/-/-/saved/searches splunk_server=local
| search action.email=1

in this way you have a list of all active alerts and reports that are sending emails and you can check if there are two alerts that generate email.

If you're sure of not, open a case to Splunk Support.

Ciao.

Giuseppe