Getting Data In
Highlighted

Multiple copies of Windows Log Events in Splunk

New Member

Hi,

We are working on events from the Windows event logs using an Universal Forwarded on our server and Splunk Enterprise...

We are seeing what appear to be multiple copies of some events in Splunk - i.e. where there are 2 events with identical properties in all fields apart from "Record Number".

Is "Record Number" a splunk determined field?

Is there a way to only show events with unique values of Record Number in splunk?

Thanks in advance,

W

Tags (3)
0 Karma
Highlighted

Re: Multiple copies of Windows Log Events in Splunk

Super Champion

Record number is a windows field. They are not truely duplicate logs.

Highlighted

Re: Multiple copies of Windows Log Events in Splunk

Ultra Champion

You can definitely search for duplicates;

your search for windows events | stats c by recordnumber, source, host | where c > 1

/k

0 Karma
Highlighted

Re: Multiple copies of Windows Log Events in Splunk

SplunkTrust
SplunkTrust

RecordNumber is Splunk determined field. If there are multiple events with same RecordNumber, your can filter those duplicate records using following:-

your base search | eventstats count by RecordNumber | where count=1 | fields - count

0 Karma