Hi
I have the following configuration in inputs.conf:
[monitor:///]
index=results
crcSalt =
sourcetype = results
My intend was to input data based on the location of the data. But the following command displays duplicates with the same source (location).
... | stats count by source
I want to know how to fix this problem.
Output:
source: count
/filename1 2/filename2 2/filename3 2/filename4 2
Edit:
There is a workaround, but undesirable because I still have duplicate data.
Workaround:
... | dedup source