same information available from many places in the log

[jalfrey]

I'm getting a dst= and also getting a porto=. Both values return the port number and they appear to be the same value. Should I call the final variable the same thing?

• How do you handle data that "might" be redundant.
• How do you make sure it is redundant?

[chris]

If the information is redundant in one single event I would configure the field extraction to only extract one value (if that is an option).

If you extract the same field from different logs/sources it makes sense to use the same field throughout your entire splunk installation. Splunk proposes the Common Information Model (CIM) to help you.

I'm afraid that checking (whether it is redundant data in single event, or verifying field content/names from different sources) your data is a manual process.

[linu1988]

If everytime its the same port number it will not create an issue if we actually ignore one value , but if its different it should be a problem. To the solution part , from my point of view we should work on to extract that field with a different name like T_port or like that.