Hello everyone,
I am streaming CloudWatch logs to SPLUNK through Firehose, and I faced the following issue:
Some json records are being indexed(?) twice and show up twice in search. The only difference between the records is the time of indexing.
I am trying to figure out how I can debug the issue. Record shows up only once in source log group in cloudwatch and s3 backups. It’s either Firehose sending a particular record twice or SPLUNK processing the same record two times. Do you have an idea how I can check my theories? I didn’t find much useful info in splunk http event collector logs. It has only technical info about the transaction: size/speed/time.
