Splunk Search

same information available from many places in the log

jalfrey
Communicator

I'm getting a dst= and also getting a porto=. Both values return the port number and they appear to be the same value. Should I call the final variable the same thing?

  • How do you handle data that "might" be redundant.
  • How do you make sure it is redundant?
0 Karma

chris
Motivator

If the information is redundant in one single event I would configure the field extraction to only extract one value (if that is an option).

If you extract the same field from different logs/sources it makes sense to use the same field throughout your entire splunk installation. Splunk proposes the Common Information Model (CIM) to help you.

I'm afraid that checking (whether it is redundant data in single event, or verifying field content/names from different sources) your data is a manual process.

0 Karma

linu1988
Champion

If everytime its the same port number it will not create an issue if we actually ignore one value , but if its different it should be a problem. To the solution part , from my point of view we should work on to extract that field with a different name like T_port or like that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...