metadata command returns duplicate sourcetypes - "WinEventLog"

[net1993]

Hello

I have this command:

| metadata type=sourcetypes index=wineventlog

The problem is that there are returned multiple lines for  "WinEventLog" sourcetype so I dont understand why that when the names are absolutely same.

I expect to get 1 line per sourcetype.

If I search with index=wineventlog and stats by sourcetype - there is no problem so it is something with metadata command

Same issue  for "wineventlog" sourcetype

[thambisetty]

Can you share sourcetypes returned from the search?

[J0el]

It could be because you have multiple sources. Check with:

| metadata type=sources index=wineventlog

 It will likely show WinEventLog:Security, WinEventLog:System, etc.