https://community.splunk.com/t5/Splunk-Search/Why-isnt-the-dedup-command-not-working-in-some-fields/m-p/410533#M118467 <P>Hi payton_tayvion,<BR /> ay first probably it's a copy error, but at the end you have dedeup instead dedup.<BR /> Then are there differences using or not the sort command?<BR /> Then have you more than 50,000 results? if yes add 0 to the sort command ( <CODE>| sort 0 l2</CODE> ).</P> <P>Bye.<BR /> Giuseppe</P> Wed, 31 Jul 2019 12:24:30 GMT gcusello 2019-07-31T12:24:30Z https://community.splunk.com/t5/Splunk-Search/Why-isnt-the-dedup-command-not-working-in-some-fields/m-p/410532#M118466 <P>Im having an issue where my contact field and l2 field is showing duplicates of the same name and when i use the dedup command nothing happens. Here's the command:<BR /> <CODE>| tstats count(Vulnerabilities.signature) as "Total Vulnerabilities" from datamodel="Vulnerabilities" where (nodename="Vulnerabilities" Vulnerabilities.severity="high" OR Vulnerabilities.severity="critical" Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*)) by Vulnerabilities.signature Vulnerabilities.property<BR /> | rename Vulnerabilities.property AS Property<BR /> | lookup kv_opsdb property as Property output contact<BR /> | lookup aws_accounts account_number AS Property OUTPUT account_name<BR /> | eval Property=if(isnull(account_name), Property, account_name)<BR /> | lookup workday.csv shortid as contact output l2<BR /> | sort - "Total Vulnerabilities"<BR /> | dedeup l2</CODE></P> <P>Heres the result:<BR /> <CODE>Vulnerabilities.signature Total Vulnerabilities Contact L2<BR /> CentOS 7 : bind (CESA-2019:1294) 129345 Jane Doe John Doe<BR /> Jane Doe John Doe<BR /> Jane Doe John Doe<BR /> Jane Doe John Doe<BR /> Jane Doe John Doe<BR /> Jane Doe John Doe<BR /> Jane Doe John Doe</CODE><BR /> and it goes on for a couple more hundred times. i just need the contact name and l2 showing once</P> Tue, 30 Jul 2019 16:57:33 GMT https://community.splunk.com/t5/Splunk-Search/Why-isnt-the-dedup-command-not-working-in-some-fields/m-p/410532#M118466 payton_tayvion 2019-07-30T16:57:33Z https://community.splunk.com/t5/Splunk-Search/Why-isnt-the-dedup-command-not-working-in-some-fields/m-p/410533#M118467 <P>Hi payton_tayvion,<BR /> ay first probably it's a copy error, but at the end you have dedeup instead dedup.<BR /> Then are there differences using or not the sort command?<BR /> Then have you more than 50,000 results? if yes add 0 to the sort command ( <CODE>| sort 0 l2</CODE> ).</P> <P>Bye.<BR /> Giuseppe</P> Wed, 31 Jul 2019 12:24:30 GMT https://community.splunk.com/t5/Splunk-Search/Why-isnt-the-dedup-command-not-working-in-some-fields/m-p/410533#M118467 gcusello 2019-07-31T12:24:30Z