How to correct duplicate entries in summary table/report

[randy_moore]

Dec 24th is the biggest day for us. During the afternoon, a summary job that populates a summary index for sales reports got delayed due to all of the searches that were happening. Consequently the job ran twice during the next hour. So now I have doubled up sales and transaction amounts for that hour.

Is there a way to find and back out the double entries from the summary index?

[aberkow]

If you know the time they were indexed (using the indextime field) you can delete https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/RemovedatafromSplunk all of the duplicate entries, assuming you meet the prerequisites listed on the page. You could also theoretically get at the duplicate entries with an eventstats command, if you tried something like:

| eventstats count by _raw
| dedup _raw, count
| delete

OR

| filtered search to the exact time/logset of the duplicated logs
| delete

but I can't say for certain without seeing an example duplicated log.