Hi,
I'm trying to pull the event logs when an account is being locked in Active Directory, but I could see multiple entries for single account, one entry for each 1 or 2 hrs . Could please help me in understanding why duplicate entries are being generated in splunk?
