Filter Duplicate Windows Events

[jchampagne]

Upon logon, multiple events with the same data are generated on our active directory domain controllers for a single user logon. We'd like to filter out the duplicate events (which occur within seconds of each other) so that only one logon event is indexed by Splunk.

Is this possible?

[gkanapathy · Accepted solution]

Not really. You can't correlate events with each other effectively in Splunk until after they are already indexed.

[jchampagne]

That was my fear. Thanks!