Splunk Search

suppression of events

Michael_Schyma1
Contributor

We have a clustered domain controller environment and we have the same results coming though on different dc's. We only want to send one per event. What is the best way of doing the suppression/throttling?

Tags (1)
1 Solution

johandk
Path Finder

See here:

http://splunk-base.splunk.com/answers/53866/filter-duplicate-windows-events

You could perhaps try to find a way of removing duplicates before Splunk indexes the events... Not sure this is feasible and adds a lot of complexity.

If storage/licensing isn't a issue you can index everything and use transactions for reporting purposes. It will group the duplicates together so you are only counting 1.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction

View solution in original post

0 Karma

johandk
Path Finder

See here:

http://splunk-base.splunk.com/answers/53866/filter-duplicate-windows-events

You could perhaps try to find a way of removing duplicates before Splunk indexes the events... Not sure this is feasible and adds a lot of complexity.

If storage/licensing isn't a issue you can index everything and use transactions for reporting purposes. It will group the duplicates together so you are only counting 1.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction

View solution in original post

0 Karma

johandk
Path Finder

I suppose we can assume this is Active Directory? 2003 or 2008?

0 Karma

Sqig
Path Finder

I assume when you say "send one per event" you mean you only want to INDEX one instance of an event and not its duplicates, is that correct? If so, we are also interested in the answer to this, because we are going to some pretty ridiculous extents to keep from indexing data from (necessarily) redundant systems.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.