Splunk Enterprise

Duplicate events

VijaySrrie
Builder

Hi Team,

Getting Duplicate events during Index time

Log ingestion method - UF

What would be done to stop duplicate events?

Labels (2)
0 Karma

VijaySrrie
Builder

All Ok with inputs and outputs, issue is only with one source.
New servers which are getting migrated are sending duplicate logs.

Need a workaround for that.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@VijaySrrie  If you know the old host which is sending duplicates you can send them to nullQueue (you have to deploy this change on HF). There will be only single source new host hence you can avoid duplicates.

venkatasri
SplunkTrust
SplunkTrust

@VijaySrrie 

how the inputs.conf looks like and does outputs.conf  any different than default settings?

0 Karma
Get Updates on the Splunk Community!

Community Feedback

We Want to Hear from You! Share Your Feedback on the Splunk Community   The Splunk Community is built for you ...

Manual Instrumentation with Splunk Observability Cloud: Implementing the ...

In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...