https://community.splunk.com/t5/Splunk-Search/How-to-filter-duplicate-KV-entries/m-p/460785#M129981 <P>Just what I needed Rich, thanks very much! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Sun, 29 Mar 2020 14:07:35 GMT RHogg 2020-03-29T14:07:35Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-duplicate-KV-entries/m-p/460783#M129979 <P>Hi guys, </P> <P>I was wondering if someone could point me in the right direction with an issue I've been having. </P> <P>Basically I have a search thats set to pull usernames from a KV lookup, the issue is theres "duplicate" entries in the lookup e.g.<BR /> Username and Username@email</P> <P>Is there any way to stop the duplicate users from appearing in the search results? I seem to be at a bit of a dead end. </P> <P>Thanks</P> Sun, 29 Mar 2020 09:01:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-duplicate-KV-entries/m-p/460783#M129979 RHogg 2020-03-29T09:01:52Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-duplicate-KV-entries/m-p/460784#M129980 <P>Those are not duplicates. If you want to filter out similar results then you need to modify your search to normalize the data. For example:</P> <PRE><CODE>... | eval username = replace(username, "@.*", "") </CODE></PRE> Sun, 29 Mar 2020 14:00:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-duplicate-KV-entries/m-p/460784#M129980 richgalloway 2020-03-29T14:00:48Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-duplicate-KV-entries/m-p/460785#M129981 <P>Just what I needed Rich, thanks very much! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Sun, 29 Mar 2020 14:07:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-duplicate-KV-entries/m-p/460785#M129981 RHogg 2020-03-29T14:07:35Z