As part of logging events from our application we add a unique GUID to the event stream is there a way to tell spunk that this is a unique id and never import two events with the same GUID field value as they would be duplicates?
Thanks
There is no way to tell Splunk that a field should not have duplicate values.