Knowledge Management

apparent dedup which sometimes occurs in summary index

shivanandbm
Explorer

in rt index we have duplicates of the events but not finding same duplicates in summery indexes.Can some one tell me what might be the case?

Labels (1)
0 Karma

woodcock
Esteemed Legend

If you are not doing an aggregation before dumping to summary index then you are doing it all wrong.

0 Karma

gaurav_maniar
Builder

please share your search query writing to summary index and some duplicate event examples

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you checked the search that populates the summary-index?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...