Duplicate Notable Events

[warsaw]

On Splunk 7.3.1.1 and now suddenly out of nowhere this issue popped up, the notable alerts are being duplicated for almost 80% of my co relation searches, when i check the raw events for those duplicates they're exactly same, so no question of duplicity of actual logs, but only for the notable alerts that are generated in Incident Review Dashboard of Enterprise Security.

Does anyone faced this issue or have resolved it?

@woodcock 

[sbaileigh]

Do you have a screenshot? Are they created on the notable index at the same time? For some of the searches, what are the triggered actions configured? Any way a series of daisy chained triggered actions leads to another notable being created?

[fmohmand]

Facing same issue  since 3 weeks.

[Vijeta]

Seeing the same issue, any solution?