Getting Data In

Getting duplicate events in splunk-ITSI indexes.

sag5757
Explorer

I have a clustered enviroment. But still getting duplicate events in splunk -ITSI indexes. Please give some recommendation . 

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
My recommendation is to better describe the problem and the Splunk environment.
Is the cluster an indexer or SH cluster? Which events are duplicated, all or some? How are the events ingested?
---
If this reply helps you, Karma would be appreciated.
0 Karma

sag5757
Explorer

Both SH and Indexer cluster is there. I have configured Splunk -ITSI with servicenow , after configuring we found that duplicate events are coming in itsi_tracked_alerts and itsi_grouped_alerts indexes

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How is the ServiceNow data getting in to Splunk?  I suspect inputs are running in more than one location, which is causing the duplicate data.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...