Splunk Enterprise

why the DB Connect input fetch the same data twice in a single run?

akarivaratharaj
Communicator

I have an input created in DB Connect app to few the necessary rows from a DB2 table. The job is scheduled to run on daily basis and to fetch only the previous day's data.

I have left the "Max rows to retrieve" and "Fetch size" to default settings. Whenever my job runs, by default it is logging the same records twice. I am not sure what is causing this issue.

I have attached screenshot of the entries belong to a primary key field where two events are indexed for each record.

Could anyone help me in troubleshooting the issue?

Labels (1)
Tags (1)
0 Karma

akarivaratharaj
Communicator

Could anyone please help me to troubleshoot this issue? I need this to be fixed as soon as possible.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

How you have defined that input on your HF (DB Connect) node? Are you sure that those events are really twice here instead of you have e.g. set both INDEX EXTRACTIONS on HF side and KV_MODE=JSON on SH side?

r. Ismo

0 Karma

akarivaratharaj
Communicator

I have created my input in DB Connect app directly from the UI of Splunk Enterprise. As I don't have permission for operations related task, I am unable to check that.

I have observed that my another input also index the data events twice. Not sure if these duplication issue is because of the fetch size which we give it in the input schedule (By the way I have left them blank to apply with default settings)

0 Karma

akarivaratharaj
Communicator

Can I get any other suggestion on trouble shooting this issue?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...