Having Splunk use a Unique Log Entry ID

cid_tangogroup · ‎07-20-2012

As part of logging events from our application we add a unique GUID to the event stream is there a way to tell spunk that this is a unique id and never import two events with the same GUID field value as they would be duplicates?

Thanks

lguinn2 · ‎07-20-2012

There is no way to tell Splunk that a field should not have duplicate values.

Having Splunk use a Unique Log Entry ID

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation

Having Splunk use a Unique Log Entry ID

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue