topic Re: Multiple copies of Windows Log Events in Splunk in Getting Data In

Multiple copies of Windows Log Events in Splunk

womblesplunk — Mon, 17 Mar 2014 17:05:41 GMT

Hi,

We are working on events from the Windows event logs using an Universal Forwarded on our server and Splunk Enterprise...

We are seeing what appear to be multiple copies of some events in Splunk - i.e. where there are 2 events with identical properties in all fields apart from "Record Number".

Is "Record Number" a splunk determined field?

Is there a way to only show events with unique values of Record Number in splunk?

Thanks in advance,

Re: Multiple copies of Windows Log Events in Splunk

lukejadamec — Mon, 17 Mar 2014 17:23:10 GMT

Record number is a windows field. They are not truely duplicate logs.

Re: Multiple copies of Windows Log Events in Splunk

kristian_kolb — Mon, 17 Mar 2014 20:24:44 GMT

You can definitely search for duplicates;

your search for windows events | stats c by recordnumber, source, host | where c > 1

Re: Multiple copies of Windows Log Events in Splunk

somesoni2 — Mon, 17 Mar 2014 21:25:30 GMT

RecordNumber is Splunk determined field. If there are multiple events with same RecordNumber, your can filter those duplicate records using following:-

your base search | eventstats count by RecordNumber | where count=1 | fields - count