Getting Data In
Highlighted

How to resolve when data getting duplicated twice in indexers?

Communicator

Hi Splunkers,

I have noticed an issue in my Splunk environment:

Issue:

Data is getting duplicated twice in indexers. If i do a search in search head, the same events are coming in twice. this issue started 2 days ago, earlier there is no issue with the data.

My Investigations:

1)checked the application logs wether same log is existing twice? Answer: No
2)Checked whether this issue is happening to one sourcetype OR only for one index OR one forwarder? Answer: No it is affecting all forwarders and indexers data.

My questions:

  • Is the issue is from the Indexer cluster side?
  • Is the issue is from the forwarder side?
  • Or any other reason why it is happening? and what are the steps need to prevent it?

Thanks in advance.

Regards,
Reddy.

Highlighted

Re: How to resolve when data getting duplicated twice in indexers?

Legend

Something changed in your configuration. Did someone change outputs.conf. on the forwarders?
If no one changed the source data files, then someone must have changed a Splunk setting in some .conf file

0 Karma
Highlighted

Re: How to resolve when data getting duplicated twice in indexers?

Communicator

@lguinn

We did not touched any config files in forwarders.

0 Karma
Highlighted

Re: How to resolve when data getting duplicated twice in indexers?

Splunk Employee
Splunk Employee

are the duplicate events coming from the same bucket or different buckets? you can isolate one of the duplicate events, and then check with bucket+splunk_server the event and its duplicates are being returned from

"somedupevent | eval bkt=bkt | fields + bkt,splunkserver"

0 Karma
Highlighted

Re: How to resolve when data getting duplicated twice in indexers?

Motivator

Seems like an issue from 6.3.x upgrade to newer version after 6.4.x would fix the issue.

View solution in original post

Highlighted

Re: How to resolve when data getting duplicated twice in indexers?

Explorer

I have the same problem and my version is Splunk Enterprise 6.5.3. Do you have an issue?

0 Karma
Highlighted

Re: How to resolve when data getting duplicated twice in indexers?

New Member

I have same issue my data is getting doubled in indexers each time a log is captured

0 Karma