Splunk Enterprise Security

Duplicate Notable Events

warsaw
Loves-to-Learn Lots

On Splunk 7.3.1.1 and now suddenly out of nowhere this issue popped up, the notable alerts are being duplicated for almost 80% of my co relation searches, when i check the raw events for those duplicates they're exactly same, so no question of duplicity of actual logs, but only for the notable alerts that are generated in Incident Review Dashboard of Enterprise Security.

Does anyone faced this issue or have resolved it?

@woodcock 

0 Karma

sbaileigh
Observer

Do you have a screenshot? Are they created on the notable index at the same time? For some of the searches, what are the triggered actions configured? Any way a series of daisy chained triggered actions leads to another notable being created?

0 Karma

fmohmand
Observer

Facing same issue  since 3 weeks.

0 Karma

Vijeta
Influencer

Seeing the same issue, any solution?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...