<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Delete overlaps from summary index in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Delete-overlaps-from-summary-index/m-p/93733#M954</link>
    <description>&lt;P&gt;You would use the &lt;A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Overlap"&gt;&lt;CODE&gt;overlap&lt;/CODE&gt;&lt;/A&gt; search command, but I'm not sure you can pipe the output of that to &lt;CODE&gt;delete&lt;/CODE&gt;, which is what I think "manually" is trying to get across.&lt;/P&gt;</description>
    <pubDate>Tue, 03 May 2011 04:09:35 GMT</pubDate>
    <dc:creator>gkanapathy</dc:creator>
    <dc:date>2011-05-03T04:09:35Z</dc:date>
    <item>
      <title>Delete overlaps from summary index</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Delete-overlaps-from-summary-index/m-p/93732#M953</link>
      <description>&lt;P&gt;The knowledge manager manual mentions ""Manually delete the overlaps from the summary index using the search language."  I'm familiar with the Delete command and how it works. But, what other command(s) would you use to pipe only the dups to the Delete command, whilst preserving only one copy of each events?&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;index=summary   search_name=xyz  et=&lt;JUST before="" first="" duplicate=""&gt;  lt=&lt;JUST after="" last="" duplicate=""&gt;   **&lt;/JUST&gt;&lt;/JUST&gt;&lt;/STRONG&gt;Twilight Zone*********  | delete**    &lt;/P&gt;

&lt;P&gt;In other words, how do I output only duplicates, but exclude one copy (or the original)?           &lt;/P&gt;</description>
      <pubDate>Tue, 03 May 2011 01:08:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Delete-overlaps-from-summary-index/m-p/93732#M953</guid>
      <dc:creator>rroberts</dc:creator>
      <dc:date>2011-05-03T01:08:07Z</dc:date>
    </item>
    <item>
      <title>Re: Delete overlaps from summary index</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Delete-overlaps-from-summary-index/m-p/93733#M954</link>
      <description>&lt;P&gt;You would use the &lt;A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Overlap"&gt;&lt;CODE&gt;overlap&lt;/CODE&gt;&lt;/A&gt; search command, but I'm not sure you can pipe the output of that to &lt;CODE&gt;delete&lt;/CODE&gt;, which is what I think "manually" is trying to get across.&lt;/P&gt;</description>
      <pubDate>Tue, 03 May 2011 04:09:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Delete-overlaps-from-summary-index/m-p/93733#M954</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2011-05-03T04:09:35Z</dc:date>
    </item>
    <item>
      <title>Re: Delete overlaps from summary index</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Delete-overlaps-from-summary-index/m-p/93734#M955</link>
      <description>&lt;P&gt;yes, I used ...index=summary search_name=productPurchased | overlap but I could not pipe to delete (This command cannot be invoked after the non-streaming command 'overlap'.) Pipe to overlap did generate a results table with overlap_latest and overlap_earliest fields but not sure how to use these.&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 09:31:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Delete-overlaps-from-summary-index/m-p/93734#M955</guid>
      <dc:creator>rroberts</dc:creator>
      <dc:date>2020-09-28T09:31:21Z</dc:date>
    </item>
  </channel>
</rss>

