Multiple copies of Windows Log Events in Splunk

[womblesplunk]

Hi,

We are working on events from the Windows event logs using an Universal Forwarded on our server and Splunk Enterprise...

We are seeing what appear to be multiple copies of some events in Splunk - i.e. where there are 2 events with identical properties in all fields apart from "Record Number".

Is "Record Number" a splunk determined field?

Is there a way to only show events with unique values of Record Number in splunk?

Thanks in advance,

W

[somesoni2]

RecordNumber is Splunk determined field. If there are multiple events with same RecordNumber, your can filter those duplicate records using following:-

your base search | eventstats count by RecordNumber | where count=1 | fields - count

[kristian_kolb]

You can definitely search for duplicates;

your search for windows events | stats c by recordnumber, source, host | where c > 1

/k

[lukejadamec]

Record number is a windows field. They are not truely duplicate logs.