Splunk Search

Searching duplicate data across indexers

New Member

Hi there

Theoretical scenario:
I have one search head and two indexers all on physical servers
I am forwarding all syslog data from the application servers to both indexers via syslog-ng
When I perform a search across the x2 search peers (indexers) will I get duplicate entries or does splunk handle this?

Many thanks
Toby

0 Karma

Legend

Because events will exist in both places, you will get duplicate entries.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!