I have deleted my entities created but after a day its gets created automatically and throwing duplicate aliases error for daily at a particular time.
once i deleted it i am not able to view the entities but its auto created next day.
I have not a restore option
ERROR:
Duplicate entity aliases found. This may cause incorrect statistical aggregation results for KPI base searches. Show duplicates. 6/7/2019 12.00
Duplicate entity aliases found. This may cause incorrect statistical aggregation results for KPI base searches. Show duplicates. 6/6/2019 12.00
The steps here show you how to delete entities, and also how to disable recurring import searches on a single instance and search head cluster: https://docs.splunk.com/Documentation/ITSI/latest/Configure/Deleteentities
Hi
Do you have any scheduled search for entity aggregation?
You can check in Settings > Data inputs > IT Service Intelligence CSV Import and the Scheduled Time for each Search
Cheers!!!