Splunk Search

Why are events duplicating when running | collect command using output_format=hec?

Pavankumar
Loves-to-Learn Lots

HI 

 

I am facing issue when running collect command event are double in new index

test  | collect index=test_1 output_format=hec

if in test index there are 100 event when running collect command  with output_format=hec then event are 200 in test_1 index.

how can I resolved this event duplication.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...