Duplicate Results on Command-Line Query vice No Duplicates via UI

[joemcmahon]

What would cause a command line query ( bin/splunk search "..." ) to return duplicate results over what the UI would return?

[ITWhisperer]

Please explain what you mean by "duplicate" results, and what is your search, does this happen for just one search or all searches, does it happen for all timeframes or just certain ones?

[joemcmahon]

Simple query, actually.

index=ourindex earliest=epoch1 latest=epoch2

Command line query returns 16 events, same query in UI returns 8 events. The 16 events have 8 duplicates.

Running 9.1.1 Splunk Enterprise. Search head cluster.

[ITWhisperer]

Do you get the same results when running the command line on all nodes in the cluster? How many nodes do you have?

[joemcmahon]

We have a 4 search head (SH) cluster. 

I just found that, when running the command line query from each SH in the cluster,  it gives me the right number of events. 

When running that same command line query from a standalone SH, I get the duplicate results.  For example, from the Monitoring Console SH, the command line query gives me the duplicate results.

Same search peers in both cases.