Splunk Search

Splunk show duplicate event but there is only one

darismendy
Explorer

Hello

I'm monitoring a directory with splunk when i search for those events it shows me by example the field id with count =2alt text

but if i search for that id it shows me only one event , why is this happening?

Tags (1)
0 Karma

somesoni2
Revered Legend

Also make sure that, the time range of both searches are exactly same.

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

If your data is coming in JSON or some other structured format and you are having fields extracted at index time then you do not need them done at search time. That is likely what is occuring here. On the search head where this is occuring set KV_MODE = none for the sourcetype that this data is in. Then it should only be extracted at index time and not at search time as well.

0 Karma

darismendy
Explorer

Hello thank you for our answer, I'm not making extractions at index time, i'm just only not truncating the incoming data

0 Karma

FrankVl
Ultra Champion

Can you share both the searches (ideally screenshots that show the search query, as well as the (relevant part of) the results?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...