Knowledge Management

How to correct duplicate entries in summary table/report

randy_moore
Path Finder

Dec 24th is the biggest day for us. During the afternoon, a summary job that populates a summary index for sales reports got delayed due to all of the searches that were happening. Consequently the job ran twice during the next hour. So now I have doubled up sales and transaction amounts for that hour.

Is there a way to find and back out the double entries from the summary index?

Labels (1)
0 Karma

aberkow
Builder

If you know the time they were indexed (using the indextime field) you can delete https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/RemovedatafromSplunk all of the duplicate entries, assuming you meet the prerequisites listed on the page. You could also theoretically get at the duplicate entries with an eventstats command, if you tried something like:

| eventstats count by _raw
| dedup _raw, count
| delete

OR

| filtered search to the exact time/logset of the duplicated logs
| delete

but I can't say for certain without seeing an example duplicated log.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...