Why are events duplicating when running | collect ...

Splunk Search

I am facing issue when running collect command event are double in new index

test | collect index=test_1 output_format=hec

if in test index there are 100 event when running collect command with output_format=hec then event are 200 in test_1 index.

how can I resolved this event duplication.

Get Updates on the Splunk Community!

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members! The ...

Why are events duplicating when running | collect command using output_format=hec?