Splunk show duplicate event but there is only one

[darismendy]

Hello

I'm monitoring a directory with splunk when i search for those events it shows me by example the field id with count =2

but if i search for that id it shows me only one event , why is this happening?

[somesoni2]

Also make sure that, the time range of both searches are exactly same.

[mdsnmss]

If your data is coming in JSON or some other structured format and you are having fields extracted at index time then you do not need them done at search time. That is likely what is occuring here. On the search head where this is occuring set KV_MODE = none for the sourcetype that this data is in. Then it should only be extracted at index time and not at search time as well.

[darismendy]

Hello thank you for our answer, I'm not making extractions at index time, i'm just only not truncating the incoming data

[FrankVl]

Can you share both the searches (ideally screenshots that show the search query, as well as the (relevant part of) the results?