Deployment Architecture

Duplicate events in every index

Loves-to-Learn Lots

I can see that we are having duplicate events in every index, query used to identify the duplicate events:

index=* |eval myID=_cd |search [search index=* |streamstats count by _raw |search count>1|eval myID=_cd |fields myID ] |stats c(myID) as dpc by index

Query used to get bucket details of these events:

index=* | eval cd=_cd | eval bkt= _bkt | table cd bkt index splunk_server _time source host sourcetype _raw


Note: SF and RF are not met and are set to 3:3. We have multisite clustered environment.

Could this issue be due to SF RF not met or somehow SH is showing up data from replicated buckets as well? Is there a fix to this?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...