topic Re: How to search for a event which is having multiple sourcetypes in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-event-which-is-having-multiple-sourcetypes/m-p/533886#M150878 <P>Try this</P><LI-CODE lang="markup">&lt;your search&gt; | stats values(sourcetype) as sourcetypes by unique_id</LI-CODE> Tue, 22 Dec 2020 20:32:21 GMT richgalloway 2020-12-22T20:32:21Z How to search for a event which is having multiple sourcetypes https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-event-which-is-having-multiple-sourcetypes/m-p/533868#M150874 <P>I have a requirement to find the duplicate events which are logged in Splunk with multiple sourcetypes.<BR />For each log we have a unique id :&nbsp;8b18881a-c6fe-4561-91f3-61c31b1afef5.&nbsp; I am able to get the logs with this unique id (multiple logs with different sourcetypes)</P><P>Is there any way to find the sourcetypes which are having the unique id, like as below.</P><P>unique id&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sourcetype1&nbsp; &nbsp; sourcetype2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;sourcetype2<BR />8b18881a-c6fe-4561-91f3-61c31b1afef5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st_dev&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st1_dev1<BR />21edc48b-0d90-43f2-bc1f-3dc6e322c821 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st_dev&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st1_dev1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st3_dev3</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 22 Dec 2020 17:58:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-event-which-is-having-multiple-sourcetypes/m-p/533868#M150874 rkishoreqa 2020-12-22T17:58:47Z Re: How to search for a event which is having multiple sourcetypes https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-event-which-is-having-multiple-sourcetypes/m-p/533886#M150878 <P>Try this</P><LI-CODE lang="markup">&lt;your search&gt; | stats values(sourcetype) as sourcetypes by unique_id</LI-CODE> Tue, 22 Dec 2020 20:32:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-a-event-which-is-having-multiple-sourcetypes/m-p/533886#M150878 richgalloway 2020-12-22T20:32:21Z