https://community.splunk.com/t5/Splunk-Search/Is-there-a-quot-keepdup-quot-command/m-p/511975#M143572 <P>HI, I am looking for something that is the 'opposite' of dedup; where the duplicate events are kept, and singular events are filtered out.</P><P>Any suggestions?</P> Fri, 31 Jul 2020 19:12:19 GMT hirschel 2020-07-31T19:12:19Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-quot-keepdup-quot-command/m-p/511975#M143572 <P>HI, I am looking for something that is the 'opposite' of dedup; where the duplicate events are kept, and singular events are filtered out.</P><P>Any suggestions?</P> Fri, 31 Jul 2020 19:12:19 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-quot-keepdup-quot-command/m-p/511975#M143572 hirschel 2020-07-31T19:12:19Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-quot-keepdup-quot-command/m-p/511980#M143576 <P>You can do something like below:</P><P>index=someindex | stats count by _raw</P><P>| where count&gt;1</P><P>The above query will return events which are duplicated.</P> Fri, 31 Jul 2020 19:28:08 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-quot-keepdup-quot-command/m-p/511980#M143576 thambisetty 2020-07-31T19:28:08Z