https://community.splunk.com/t5/Getting-Data-In/Filter-Duplicate-Windows-Events/m-p/106470#M22415 <P>Not really. You can't correlate events with each other effectively in Splunk until after they are already indexed.</P> Tue, 24 Jul 2012 04:44:32 GMT gkanapathy 2012-07-24T04:44:32Z https://community.splunk.com/t5/Getting-Data-In/Filter-Duplicate-Windows-Events/m-p/106469#M22414 <P>Upon logon, multiple events with the same data are generated on our active directory domain controllers for a single user logon. We'd like to filter out the duplicate events (which occur within seconds of each other) so that only one logon event is indexed by Splunk.</P> <P>Is this possible?</P> Tue, 24 Jul 2012 02:05:17 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-Duplicate-Windows-Events/m-p/106469#M22414 jchampagne 2012-07-24T02:05:17Z https://community.splunk.com/t5/Getting-Data-In/Filter-Duplicate-Windows-Events/m-p/106470#M22415 <P>Not really. You can't correlate events with each other effectively in Splunk until after they are already indexed.</P> Tue, 24 Jul 2012 04:44:32 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-Duplicate-Windows-Events/m-p/106470#M22415 gkanapathy 2012-07-24T04:44:32Z https://community.splunk.com/t5/Getting-Data-In/Filter-Duplicate-Windows-Events/m-p/106471#M22416 <P>That was my fear. Thanks!</P> Tue, 24 Jul 2012 14:28:20 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-Duplicate-Windows-Events/m-p/106471#M22416 jchampagne 2012-07-24T14:28:20Z