Dashboards & Visualizations

My sourcetype is getting doubled up

dtccsundar
Path Finder

I am fetching data from Data Warehouse (view ) .i can give an example for this issue ,

Sourcetype =K_domain_counts ( has 350 rows)

I am scheduling this at 9.00 AM everyday using splunk DB connect .When i see the sourcetype nextday at 9.00 AM getting doubled up data ( like 700 rows 350 + 350 ).IT has duplicate values .The sourcetype will come to normal after an hour or so to 350 rows.

I am keeping last 24 hours as the time frame .I know this causes this issue .But i need to have data in dashboard for 24 hours and should not show "No data" in dashboard .I tried using dedup but it removes data from actual days data .

Can some one help me to resolve this issue .I need to have next days data got refreshed after 9.00 AM without doubling up .

 

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...