https://community.splunk.com/t5/Getting-Data-In/Remove-duplicate-unwanted-data-before-indexing/m-p/380767#M100238 <P>How can i remove duplicate data which comes from a udp input,<BR /> for example:</P> <PRE><CODE>Nov 9 10:27:33 192.168.X.Y Nov 9 10:27:33 my_hostname syslog: DATA=xxx </CODE></PRE> <P>But i want only the data part indexed:</P> <PRE><CODE> DATA=xxx </CODE></PRE> <P>Many thanks</P> Fri, 09 Nov 2018 09:45:22 GMT mkrauss1 2018-11-09T09:45:22Z https://community.splunk.com/t5/Getting-Data-In/Remove-duplicate-unwanted-data-before-indexing/m-p/380767#M100238 <P>How can i remove duplicate data which comes from a udp input,<BR /> for example:</P> <PRE><CODE>Nov 9 10:27:33 192.168.X.Y Nov 9 10:27:33 my_hostname syslog: DATA=xxx </CODE></PRE> <P>But i want only the data part indexed:</P> <PRE><CODE> DATA=xxx </CODE></PRE> <P>Many thanks</P> Fri, 09 Nov 2018 09:45:22 GMT https://community.splunk.com/t5/Getting-Data-In/Remove-duplicate-unwanted-data-before-indexing/m-p/380767#M100238 mkrauss1 2018-11-09T09:45:22Z