Splunk Enterprise Security Search Head returning dual events

[bsuresh1]

We are using Splunk 6.5 environment with 5 (4+1) Search Heads where the latest SH is dedicated for Enterprise Security app and this was installed few weeks back. Only in this ES Search Head, we are getting dual events. If we get 50 events in other 4 Search Heads, we are getting 100 events in ES search head.

Could you please let me know how to fix this?

[esix_splunk]

ES is a very complex App to setup and configure. Without knowing how your core Splunk deployment is built out, it is very difficult to assist on this. If this is a new deployment, I would find out who deployed it and talk to them. Typically Splunk requires Pro Serv for ES deployments, and partners follow the same model. So if this is a new deployment, talking to the team that deployed would be your quickest solution.

There could potentially be a lot of issues here.

Can you describe your deployment? How many indexers, cluster configuration, search head configuration etc?

Is this a new deployment? Or did you inherit it from another admin?

[bsuresh1]

Splunk professionals have deployed ES app and all the configurations were made by them.

In Indexer clustering, we have 8 indexers and 3 SH's. As per the below link, I understand that we need to configure indexer clustering for the Search Head to have no duplicate events. I am going to do this and check.

Please let me know if any other suggestion.

https://answers.splunk.com/answers/481498/how-to-prevent-duplicate-events-from-occurring-whe.html