why the DB Connect input fetch the same data twice in a single run?

[akarivaratharaj]

I have an input created in DB Connect app to few the necessary rows from a DB2 table. The job is scheduled to run on daily basis and to fetch only the previous day's data.

I have left the "Max rows to retrieve" and "Fetch size" to default settings. Whenever my job runs, by default it is logging the same records twice. I am not sure what is causing this issue.

I have attached screenshot of the entries belong to a primary key field where two events are indexed for each record.

Could anyone help me in troubleshooting the issue?

[akarivaratharaj]

Could anyone please help me to troubleshoot this issue? I need this to be fixed as soon as possible.

[isoutamo]

Hi

How you have defined that input on your HF (DB Connect) node? Are you sure that those events are really twice here instead of you have e.g. set both INDEX EXTRACTIONS on HF side and KV_MODE=JSON on SH side?

r. Ismo

[akarivaratharaj]

I have created my input in DB Connect app directly from the UI of Splunk Enterprise. As I don't have permission for operations related task, I am unable to check that.

I have observed that my another input also index the data events twice. Not sure if these duplication issue is because of the fetch size which we give it in the input schedule (By the way I have left them blank to apply with default settings)

[akarivaratharaj]

Can I get any other suggestion on trouble shooting this issue?