Looking through the reports we are noticing the graphs and results are inflated because they are counting a single event as multiple events. For example, say a user gets locked out, we have 3 domain controllers so a single user unlockout event is getting counted as the user getting locked out 3 times instead of just once. likewise the workstation will also report the lockout so we get a workstation user event, a domain controller event(s) all couting as multiple events even though its a single instance. How can we correct this so events from different sources are recognized as the same event?