Getting Data In

How to deal with data that was uploaded twice?

Path Finder

Hi Experts,

I am now in a strange situation, we have a index in which we uploaded .csv files for every month and for previous month data has been uploaded two times. now splunk is showing duplicate entries.

Can someone please suggest how can I get through this situation?
I want to remove duplicate entries for last month from index.



Revered Legend

You can use delete command to remove those duplicate records from any future search (it actually makes those records unsearchable but doesn't actually deletes it/removes from disk). See this for more information on the same.

Please ensure that you run the search without delete command first and validate that you got only the records that you want to delete.

0 Karma

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...