Radius event issue with wmi.conf - Splunk Community

Getting Data In

Hi all,

We have a radius server forwarding information to splunk. When we look into the events, we can see that Splunk collects again and again the same events (ex: RecordNumber=14478 on last 24 hours -> 412 events). We are quering the server via wmi configuration. Is there any way to avoid this behaviour?

Thanks in advance.

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with another ...