We have many instances where duplicate data has been coming due to server instances running in wrong manner. Because of that duplicate has found to be indexed.
Is there is config change we can do on Forwarder or Indexer to stop indexing supplicate entries.
Neither forwarder nor indexer can deduplicate events at index time. You must correct the manner in which the server instances run.
You can, however, use dedup
to deduplicate events at search time or use the delete
command to hide the duplicates.
Neither forwarder nor indexer can deduplicate events at index time. You must correct the manner in which the server instances run.
You can, however, use dedup
to deduplicate events at search time or use the delete
command to hide the duplicates.