https://community.splunk.com/t5/Splunk-Search/Return-daily-unique-field/m-p/58095#M14191 <P>The mday does the same as "|timechart span=1d count" would. However it still removes all of the duplicates. (does not save duplicates if they happen on different days)</P> Tue, 29 May 2012 03:27:48 GMT zucler 2012-05-29T03:27:48Z https://community.splunk.com/t5/Splunk-Search/Return-daily-unique-field/m-p/58093#M14189 <P>Hi guys,</P> <P>As I understand, <STRONG>dedup</STRONG> command will filter the complete set of results and remove any duplicate fields.</P> <P>What if I want it to remove daily duplicates only? In other words, I would like to have duplicates, if their events happened on different days.</P> <P>Is this possible?</P> <P>Thanks,<BR /> Max</P> Wed, 23 May 2012 07:52:33 GMT https://community.splunk.com/t5/Splunk-Search/Return-daily-unique-field/m-p/58093#M14189 zucler 2012-05-23T07:52:33Z https://community.splunk.com/t5/Splunk-Search/Return-daily-unique-field/m-p/58094#M14190 <P>Dedup based on day as well:</P> <PRE><CODE>... | eval mday = strftime(_time,"%d") | dedup yourfirstfield mday </CODE></PRE> Wed, 23 May 2012 08:05:19 GMT https://community.splunk.com/t5/Splunk-Search/Return-daily-unique-field/m-p/58094#M14190 Ayn 2012-05-23T08:05:19Z https://community.splunk.com/t5/Splunk-Search/Return-daily-unique-field/m-p/58095#M14191 <P>The mday does the same as "|timechart span=1d count" would. However it still removes all of the duplicates. (does not save duplicates if they happen on different days)</P> Tue, 29 May 2012 03:27:48 GMT https://community.splunk.com/t5/Splunk-Search/Return-daily-unique-field/m-p/58095#M14191 zucler 2012-05-29T03:27:48Z https://community.splunk.com/t5/Splunk-Search/Return-daily-unique-field/m-p/58096#M14192 <P>Indeed it does the same. I'm confused regarding what behaviour you want. Could you show an example of desired vs undesired behaviour?</P> Tue, 29 May 2012 04:18:12 GMT https://community.splunk.com/t5/Splunk-Search/Return-daily-unique-field/m-p/58096#M14192 Ayn 2012-05-29T04:18:12Z