Getting Data In

Getting duplicate events in splunk-ITSI indexes.

sag5757
Explorer

I have a clustered enviroment. But still getting duplicate events in splunk -ITSI indexes. Please give some recommendation . 

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
My recommendation is to better describe the problem and the Splunk environment.
Is the cluster an indexer or SH cluster? Which events are duplicated, all or some? How are the events ingested?
---
If this reply helps you, Karma would be appreciated.
0 Karma

sag5757
Explorer

Both SH and Indexer cluster is there. I have configured Splunk -ITSI with servicenow , after configuring we found that duplicate events are coming in itsi_tracked_alerts and itsi_grouped_alerts indexes

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How is the ServiceNow data getting in to Splunk?  I suspect inputs are running in more than one location, which is causing the duplicate data.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...