I had set up a summary schedule reports with calculated results every 5 minutes.
Howerver, The same summary schedule is performed twice a month irregularly, about twice a month.
The result is doubled.
Looking at the internal log, there is a log in which the same schedule is executed twice with a slight time difference.
Splunk version 7.3.5
3 Search Header sh1, sh2, sh3, (clusting)
4 indexers (clustering) , indexer clustermater
havyforwarder
ex)
01:10 summary result 5
01:15 summary result 5
01:20 summary result 5
01:20 summary result 5 (Duplicates)
01:25 summary result 5
Is there anything I need to check?
Are there any issues or workarounds for this?
I am using dedup to filter.
