https://community.splunk.com/t5/Getting-Data-In/pipe-in-srchFilter/m-p/40266#M7472 <P>Search filters can only contain argument to the "search" command: ANDs/ORs/NOTs of keywords and fields.</P> Tue, 08 Feb 2011 00:51:42 GMT Stephen_Sorkin 2011-02-08T00:51:42Z https://community.splunk.com/t5/Getting-Data-In/pipe-in-srchFilter/m-p/40265#M7471 <P>I would like to apply a dedup to all searches performed by users in a certain role. Is there a way to do this with the srchFilter option? I have tried setting this to "| dedup _raw" but it seems this creates unbalanced parentheses in my query.</P> <P><EM>Just a little background: I have indexers across 2 sites with data being replicated by forwarders for redundancy for one index. I'm trying to avoid duplicate results in that index when distributing the search across all indexers.</EM></P> Tue, 08 Feb 2011 00:30:40 GMT https://community.splunk.com/t5/Getting-Data-In/pipe-in-srchFilter/m-p/40265#M7471 nvtssplunk 2011-02-08T00:30:40Z https://community.splunk.com/t5/Getting-Data-In/pipe-in-srchFilter/m-p/40266#M7472 <P>Search filters can only contain argument to the "search" command: ANDs/ORs/NOTs of keywords and fields.</P> Tue, 08 Feb 2011 00:51:42 GMT https://community.splunk.com/t5/Getting-Data-In/pipe-in-srchFilter/m-p/40266#M7472 Stephen_Sorkin 2011-02-08T00:51:42Z https://community.splunk.com/t5/Getting-Data-In/pipe-in-srchFilter/m-p/40267#M7473 <P>Ok, so that's the anti-solution. Is there another way to accomplish this?</P> Tue, 08 Feb 2011 23:02:25 GMT https://community.splunk.com/t5/Getting-Data-In/pipe-in-srchFilter/m-p/40267#M7473 nvtssplunk 2011-02-08T23:02:25Z https://community.splunk.com/t5/Getting-Data-In/pipe-in-srchFilter/m-p/40268#M7474 <P>This is actually technically possible but NOT SUPPORTED BY SPLUNK! reference this question and please upgoat. </P> <P><A href="http://answers.splunk.com/answers/314192/use-srchfilter-to-anonymize-data-based-on-role.html#answer-314196">http://answers.splunk.com/answers/314192/use-srchfilter-to-anonymize-data-based-on-role.html#answer-314196</A></P> Fri, 02 Oct 2015 16:21:07 GMT https://community.splunk.com/t5/Getting-Data-In/pipe-in-srchFilter/m-p/40268#M7474 RicoSuave 2015-10-02T16:21:07Z