Why are events duplicating when running | collect ...

Splunk Search

I am facing issue when running collect command event are double in new index

test | collect index=test_1 output_format=hec

if in test index there are 100 event when running collect command with output_format=hec then event are 200 in test_1 index.

how can I resolved this event duplication.

Get Updates on the Splunk Community!

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Why are events duplicating when running | collect command using output_format=hec?