https://community.splunk.com/t5/Splunk-Search/Unique-requests/m-p/402162#M116388 <P>Like this:</P> <PRE><CODE>index=_* sourcetype="audittrail" | rex "(?ms)search='(?&lt;search&gt;.*)$$" | rex field=search mode=sed "s/', autojoin='1',.*$$//" | regex search="(^|[\s\\r\n(])sourcetype\s*=\s*\"?(?i)(wmi:)?(win|xml)eventlog(\*|:\*|:system|:security|:application)" | stats dc(search) </CODE></PRE> Sun, 21 Jul 2019 16:23:08 GMT woodcock 2019-07-21T16:23:08Z https://community.splunk.com/t5/Splunk-Search/Unique-requests/m-p/402160#M116386 <P>Need creating a search query for Splunk that results in a list of unique requests that have been completed.</P> Sun, 21 Jul 2019 05:08:07 GMT https://community.splunk.com/t5/Splunk-Search/Unique-requests/m-p/402160#M116386 d00m4ig 2019-07-21T05:08:07Z https://community.splunk.com/t5/Splunk-Search/Unique-requests/m-p/402161#M116387 <P>... | stats dc(someField) </P> Sun, 21 Jul 2019 15:04:00 GMT https://community.splunk.com/t5/Splunk-Search/Unique-requests/m-p/402161#M116387 jkat54 2019-07-21T15:04:00Z https://community.splunk.com/t5/Splunk-Search/Unique-requests/m-p/402162#M116388 <P>Like this:</P> <PRE><CODE>index=_* sourcetype="audittrail" | rex "(?ms)search='(?&lt;search&gt;.*)$$" | rex field=search mode=sed "s/', autojoin='1',.*$$//" | regex search="(^|[\s\\r\n(])sourcetype\s*=\s*\"?(?i)(wmi:)?(win|xml)eventlog(\*|:\*|:system|:security|:application)" | stats dc(search) </CODE></PRE> Sun, 21 Jul 2019 16:23:08 GMT https://community.splunk.com/t5/Splunk-Search/Unique-requests/m-p/402162#M116388 woodcock 2019-07-21T16:23:08Z https://community.splunk.com/t5/Splunk-Search/Unique-requests/m-p/402163#M116389 <P>Thank you very much!</P> Sun, 21 Jul 2019 17:04:47 GMT https://community.splunk.com/t5/Splunk-Search/Unique-requests/m-p/402163#M116389 d00m4ig 2019-07-21T17:04:47Z