Getting Data In

Multiple copies of Windows Log Events in Splunk

womblesplunk
New Member

Hi,

We are working on events from the Windows event logs using an Universal Forwarded on our server and Splunk Enterprise...

We are seeing what appear to be multiple copies of some events in Splunk - i.e. where there are 2 events with identical properties in all fields apart from "Record Number".

Is "Record Number" a splunk determined field?

Is there a way to only show events with unique values of Record Number in splunk?

Thanks in advance,

W

Tags (3)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

RecordNumber is Splunk determined field. If there are multiple events with same RecordNumber, your can filter those duplicate records using following:-

your base search | eventstats count by RecordNumber | where count=1 | fields - count

0 Karma

kristian_kolb
Ultra Champion

You can definitely search for duplicates;

your search for windows events | stats c by recordnumber, source, host | where c > 1

/k

0 Karma

lukejadamec
Super Champion

Record number is a windows field. They are not truely duplicate logs.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...