I am not seeing attachments or other screenshots.   Usually when I see duplicate events like this it has been because a file was replicated somehow "underneath" Splunk within a directory where Splunk thinks it is a new file and starts indexing it again. Or, I've seen this happen if you have the log files going to a shared mount point and two different Forwarders are pointing at the same files.  A few questions to help you troubleshoot: - You mention splunk-server.  What does the splunk_server field, along with values of things like host, sourcetype, and source look like for these events?  - Your timestamps are wildly off, and not necessarily in a predictable way (e.g. just by 1 hour).  Does your log data have timestamps within it, or are you relying on the timestamp being derived from when Splunk "sees" your log? - Have you poked around in the _internal index to see where Splunk "saw" any files matching the following: /var/log/acobjson/*100223*rtm*  NOTE:  Don't look for source=/var/log/acobjson/*100223*rtm* in index=_internal, because the source= in this context refers to the Splunk log files that were indexed.  You can start without specifying a field, but you can also try something like index=_internal series=/var/log/acobjson/*100223*rtm* since that is one field Splunk will log this info in as it is monitoring files.

Hi @mm7 , please try something like this: <your_search> | rex "^\[(?<status>[^\]]*)" | stats dc(status) AS status_count values(status) AS status BY task id | where status_count=1 AND status="sent" | table task id status ciao. Giuseppe