Duplicate Data In Sourcetype

[jbender72]

Hello,

I have two Domain Controllers that are producing a lot of data, pushing my daily usage over the limit.  I saw that sourcetype WinNetMon and Perfmon:process have the most duplicate logs in them.  How do I reduce the duplication before the indexing occurs saving me on my daily usage?

Thank You

[General_Talos · Accepted solution]

Effectively this is not possible to identify/remove duplicate data before indexing.

Since Perfmon:process is always noisy, would recommend to filter only relevant/required data.

[jbender72]

ok, thank you