topic Re: How do I dedupe splunk results? in Getting Data In

How do I dedupe splunk results?

jtlewis — Fri, 03 Feb 2012 00:48:32 GMT

Sometimes in splunk I get a lot of duplicate results, is there a dedupe command I can use to narrow the results?

Re: How do I dedupe splunk results?

lpolo — Fri, 03 Feb 2012 01:35:20 GMT

You can use the search command dedup. Example:

|dedup name_of_your_field

More information:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/dedup

Re: How do I dedupe splunk results?

wsmierciak — Mon, 28 Sep 2020 18:13:23 GMT

I tried this and all of my results disappear and i have 0 results.

My code is:
Latency_-Session_Average > 50
| search host=servername
| sort -size -Latency-Session_Average
|table UserName, host, Latency-_Session_Average, RACF_ID, Event_Date, Event_Time, ICA_Name
|dedup USERNAME

If I remove dedup, i get all results, but multiples of each user in the results

Re: How do I dedupe splunk results?

mendesjo — Mon, 14 Sep 2015 18:30:00 GMT

same problem..

Re: How do I dedupe splunk results?

jsven7 — Tue, 15 Dec 2015 21:38:41 GMT

Same problem

Re: How do I dedupe splunk results?

subash730 — Tue, 06 Dec 2016 15:27:55 GMT

I need all the duplicates also displayed in the table command. But table command only displays unique values for fields. How to display all duplicate values using Table command.

Suppose I have 8 fields to be displayed and two of those fields have unique values for each and every row of data and all other 6 fields have common data, table displays all those 6 fields data once and displays these two fields data only in bulk.

Re: How do I dedupe splunk results?

sankeerthankala — Tue, 29 Sep 2020 18:48:08 GMT

use the | dedup before the | table pipe, it should work
more like below

Latency_-Session_Average > 50
| search host=servername
| sort -size -Latency-Session_Average
|dedup USERNAME
|table UserName, host, Latency-_Session_Average, RACF_ID, Event_Date, Event_Time, ICA_Name

Re: How do I dedupe splunk results?

lucorrea — Wed, 03 Jul 2019 19:18:40 GMT

I'm having the same problem with dedup.
Has anyone been able to use it without losing all results?
Or maybe you have a different command that can help removing duplicates?
Thanks.