Will Splunk ingest the same data if it is sent to ... - Splunk Community

Getting Data In

I currently see the wineventlog:security as a source under my wineventlog index for the Splunk_TA_Windows app
and also under my main index.

Is it possible I am indexing this data twice?
Will Splunk ingest the same data if it is sent to two different indexes?

It is highly unlikely. Figure out what host is sending, go to that host, and do this:

$SPLUNK_HOME btool list inputs --debug

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...