Events Deduplication feature on Splunk Cloud

prashanthan1987

Looking for an feasibility or future release plan of Events Deduplication on Splunk Cloud either using EP / IP.

richgalloway

Deduplication at ingest time is tricky bordering on impossible. Duplicate events may follow different paths and so be undetectable until search time. Even if they follow a common path, they may be sufficiently far apart that the EP/IP worker can't detect the duplication.

---
If this reply helps you, Karma would be appreciated.

Events Deduplication feature on Splunk Cloud

administration

configuration

Splunk Investigate

using Splunk Cloud

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Accelerating Observability as Code with the Splunk AI Assistant

Join the Conversation

Events Deduplication feature on Splunk Cloud

administration

configuration

Splunk Investigate

using Splunk Cloud

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Accelerating Observability as Code with the Splunk AI Assistant