https://community.splunk.com/t5/Getting-Data-In/Multiline-events-ingested-by-Splunk-at-different-times-How-to/m-p/518959#M87784 <P>If done correctly, multi-line events will be indexed as a single event and duplication is an unlikely problem.</P> Thu, 10 Sep 2020 21:00:19 GMT richgalloway 2020-09-10T21:00:19Z https://community.splunk.com/t5/Getting-Data-In/Multiline-events-ingested-by-Splunk-at-different-times-How-to/m-p/518948#M87775 <P>Hi,</P><P>Had a customer who was using a TA to get data from Cisco ESA into Splunk. They wondered whether or not it was possible to get multiline-events into Splunk from different data sources at different times and not have duplicate events as a result in Splunk.</P><P>Any help on this issue would be greatly appreciated.</P> Thu, 10 Sep 2020 19:31:25 GMT https://community.splunk.com/t5/Getting-Data-In/Multiline-events-ingested-by-Splunk-at-different-times-How-to/m-p/518948#M87775 malmoore 2020-09-10T19:31:25Z https://community.splunk.com/t5/Getting-Data-In/Multiline-events-ingested-by-Splunk-at-different-times-How-to/m-p/518959#M87784 <P>If done correctly, multi-line events will be indexed as a single event and duplication is an unlikely problem.</P> Thu, 10 Sep 2020 21:00:19 GMT https://community.splunk.com/t5/Getting-Data-In/Multiline-events-ingested-by-Splunk-at-different-times-How-to/m-p/518959#M87784 richgalloway 2020-09-10T21:00:19Z