We have a clustered domain controller environment and we have the same results coming though on different dc's. We only want to send one per event. What is the best way of doing the suppression/throttling?
I assume when you say "send one per event" you mean you only want to INDEX one instance of an event and not its duplicates, is that correct? If so, we are also interested in the answer to this, because we are going to some pretty ridiculous extents to keep from indexing data from (necessarily) redundant systems.