suppression of events

[Michael_Schyma1]

We have a clustered domain controller environment and we have the same results coming though on different dc's. We only want to send one per event. What is the best way of doing the suppression/throttling?

[johandk · Accepted solution]

See here:

http://splunk-base.splunk.com/answers/53866/filter-duplicate-windows-events

You could perhaps try to find a way of removing duplicates before Splunk indexes the events... Not sure this is feasible and adds a lot of complexity.

If storage/licensing isn't a issue you can index everything and use transactions for reporting purposes. It will group the duplicates together so you are only counting 1.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction

[johandk]

I suppose we can assume this is Active Directory? 2003 or 2008?

[Sqig]

I assume when you say "send one per event" you mean you only want to INDEX one instance of an event and not its duplicates, is that correct? If so, we are also interested in the answer to this, because we are going to some pretty ridiculous extents to keep from indexing data from (necessarily) redundant systems.