How to integrate Splunk with servicenow without duplicate table records?

[abhishekroy168]

Hi all,
I have integrated splunk with servicenow to get all tables from servicenow.
Recently I observed that whenever I am updating a table in servicenow i get 2 copies of it in Splunk .
I mean whenever there is an update for a table in servicenow for N number of times I am getting N numbers of a table in Splunk even though there is only 1 table in servicenow.
Please do help if any of you have any leads regarding this:)

[jslay_splunk]

This is expected behavior. You get a copy of every "state" of the record in splunk. You should just look at the latest record to get the most updated information. You can do this with |dedup sys_id

[abhishekroy168]

thanks @jslay for the answer.
I have done the same thing using distinct_count.
But I need something OOTB which can do it during the process of data plucking from servicenow.
Because using dedup for every query will make it fuzzy:)