How do I prevent duplicate events in the summary using a search with tscollect?

[gcusello]

Hi at all,

I'm using the BlueCoat App: this App uses tscollect to accelerate searches.
My problem is that I haven't a continuous stream of logs from BlueCoat, but the logs are loaded into a directory every hour and then taken by the Universal Forwarder.
So there isn't a fixed interval to run the search using tscollect, and if I extend the time range, some data in the summary are duplicated.

Is there a method to not re-acquire data already acquired in the summary?
Thank you in advance.
Bye.
Giuseppe

[gcusello · Accepted solution]

The only way is to collect in the tscollect also the source field and exclude in the search the fields already summarizeds

[gcusello]

to workaround the problem, I scheduled the tscollect search in a fixed time (from -120m to -60m) in this way probably I havent duplications.