I'm using the BlueCoat App: this App uses tscollect to accelerate searches.
My problem is that I haven't a continuous stream of logs from BlueCoat, but the logs are loaded into a directory every hour and then taken by the Universal Forwarder.
So there isn't a fixed interval to run the search using tscollect, and if I extend the time range, some data in the summary are duplicated.
Is there a method to not re-acquire data already acquired in the summary?
Thank you in advance.