About rupesh26

dagar_ruralking · ‎09-09-2020

So, I know this is an older post, but I am having this problem as well. I am seeing the 4624 and then also the 4776. So, the question is should we tweak the windows TA to remove the tags for all but the 4624 events?

nick405060 · ‎01-28-2020

Also for reference https://answers.splunk.com/answers/789749/dedup-vs-stats-performance.html (I am on the same page as you in that 99.9999% of the time I want to keep my other fields as well, which makes stats values absolutely useless in this "debate")

richgalloway · ‎09-25-2019

@krishnakesiraju If your problem is resolved, please accept an answer to help future readers.

rupesh26 · ‎09-18-2019

That Helped 🙂 Thanks

shocko · ‎09-11-2019

Thanks so much! That worked 🙂

rupesh26 · ‎09-09-2019

Hi All, The issue got fixed, after updating the hostnames to fully qualified hosts in serverclass. Its always better to use full host names to avoid these issues 🙂 Thanks @HiroshiSatoh for helping out.

rupesh26 · ‎09-09-2019

can you try this [your_sourcetype] TIME_PREFIX=\d+.\d+.\d+.\d+\s\w+\s TIME_FORMAT=%s.%2N

Posts	23
Solutions	3
Karma Given	10
Karma Received	6
Member Since	‎09-03-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Alternate to dedup

Arrange non-null values in a field

DS not pushing app to DC

Re: authentication searches return extra events

Re: Alternate to dedup

Re: CSV File with 'timestamp' field - Splunk adds ...

Re: Arrange non-null values in a field

Re: Forward Events to Multiple Seperate Indexers

Re: DS not pushing app to DC

Re: Help me write my props.con for this log?

Are you a member of the Splunk Community?