topic Re: How do I prevent duplicate events in the summary using a search with tscollect? in Getting Data In

How do I prevent duplicate events in the summary using a search with tscollect?

gcusello — Mon, 18 Apr 2016 14:48:40 GMT

Hi at all,

I'm using the BlueCoat App: this App uses tscollect to accelerate searches.
My problem is that I haven't a continuous stream of logs from BlueCoat, but the logs are loaded into a directory every hour and then taken by the Universal Forwarder.
So there isn't a fixed interval to run the search using tscollect, and if I extend the time range, some data in the summary are duplicated.

Is there a method to not re-acquire data already acquired in the summary?
Thank you in advance.
Bye.
Giuseppe

Re: How do I prevent duplicate events in the summary using a search with tscollect?

gcusello — Mon, 18 Apr 2016 15:09:50 GMT

to workaround the problem, I scheduled the tscollect search in a fixed time (from -120m to -60m) in this way probably I havent duplications.

Re: How do I prevent duplicate events in the summary using a search with tscollect?

gcusello — Mon, 27 Jun 2016 10:14:24 GMT

The only way is to collect in the tscollect also the source field and exclude in the search the fields already summarizeds