Invalid: -x
option in logon-summary
and eid-metrics
will result in duplicate results
#1478
Labels
invalid
This doesn't seem right
Turning on
-x
to carve records from slack will often result in duplicate events being read, however,logon-summary
andeid-metrics
does not do any filtering for duplicate events. I think we need to keep track of timestamp, etc.. information for events only when-x
is being used and filter on duplicate events before giving results in order to give more accurate results.The text was updated successfully, but these errors were encountered: