I currently see the wineventlog:security as a source under my wineventlog index for the Splunk_TA_Windows app and also under my main index. Is it possible I am indexing this data twice? Will splunk ingest the same data if it is sent to two different indexes?
↧