| Description | This article describes how to troubleshoot the 'duplicate entry' error encountered when adding a new item to the FortiSIEM Watchlist. |
| Scope | FortiSIEM. |
| Solution |
This error can occur if the entry value trying to add already exists in the Watchlist - even if it belongs to a different organization.
However, when searching for the entry in the Watchlist in the GUI, no results may appear.
To verify whether the value exists in another organization or watchlist, use the following SQL query:
# psql -U phoenix phoenixdb -c "SELECT * FROM ph_dwl_entry WHERE entry_value='abc.com';"
Even if the entry is not visible in the GUI, it might still exist in another organization. The command above will confirm its presence, as shown below:
If the entry is found and needs to be removed, delete it using the following command:
# psql -U phoenix -d phoenixdb -c "DELETE FROM ph_dwl_entry WHERE entry_value='abc.com';"
After deleting the duplicate entry, try adding it to the Watchlist again - it should now be successful. |
