Getting duplicate events in splunk-ITSI indexes.

[sag5757]

I have a clustered enviroment. But still getting duplicate events in splunk -ITSI indexes. Please give some recommendation . 

[richgalloway]

My recommendation is to better describe the problem and the Splunk environment.
Is the cluster an indexer or SH cluster? Which events are duplicated, all or some? How are the events ingested?

[sag5757]

Both SH and Indexer cluster is there. I have configured Splunk -ITSI with servicenow , after configuring we found that duplicate events are coming in itsi_tracked_alerts and itsi_grouped_alerts indexes

[richgalloway]

How is the ServiceNow data getting in to Splunk?  I suspect inputs are running in more than one location, which is causing the duplicate data.