Is there known bug in DB Connect causing scheduled jobs to run twice.. We had an incident over the weekend and messed up the report showing doubled events
Not that I know... but are you using DB Dump or DB Tail?
If you're using DB Tail, it stores the last value at $SPLUNK_HOME/var/lib/splunk/persistentstorage/dbx
, where each DB Tail configuration has its own directory and it saves the value for the "tailing" process insice state.xml
.
If the process failed in the middle or something happen where this file wasn't updated, the next run will insert duplicated entries.