topic Re: How to remove duplicate events in INDEX , not on Search ? in Splunk Search

How to remove duplicate events in INDEX , not on Search ?

jadengoho — Mon, 11 Dec 2017 03:07:44 GMT

I do have many data including duplicate data , and i want to remove duplicate data from the index , without using the ""DEDUP" command since it only remove the event on SEARCH not in INDEX , can somebody help me ?

Re: How to remove duplicate events in INDEX , not on Search ?

nickhills — Mon, 11 Dec 2017 08:49:50 GMT

You will need to create a search which finds your duplicated data, and returns all but the last copy (or first - depending on your needs).
Once you are happy your search correctly identifies ONLY the duplicated events you can pipe the results to |delete which will remove the data from the indexes.

You will need to be a user with 'can delete' permissions - no user has this be default (not even admin) so you may need to add this capability to your user first - its also a good idea to remove this capability when you have finished to prevent accidents! (been there)

Its worth noting that this will not remove the data from disk - it simply marks it as deleted in the buckets, so it wont be returned in future searches

Re: How to remove duplicate events in INDEX , not on Search ?

niketn — Mon, 11 Dec 2017 08:55:27 GMT

@jadengoho, are these duplicates old or your data will keep on having duplicate data in future as well? If there will be duplicates, what is the source/cause/frequency of duplicate data?

Re: How to remove duplicate events in INDEX , not on Search ?

jadengoho — Mon, 11 Dec 2017 08:57:29 GMT

it is a daily logs data , so duplicate data is a problem , cause they are just stacking .

Re: How to remove duplicate events in INDEX , not on Search ?

niketn — Mon, 11 Dec 2017 10:00:53 GMT

If you can fix data while ingestion that would be best. Else you can run a daily scheduled search (to run after data is ingested), which will list all daily data with dedup and push it to separate index.

Refer to Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect#Moving_events_to_a_different_index

PS:
You can use collect command to do this, however, to me seems overhead unless fixed prior to indexing.
You can also think of scripted input to do this in case there are no other means of preventing duplicated events from being indexed.
Using collect command if you define sourcetype other than stash, it will count against your license.

Re: How to remove duplicate events in INDEX , not on Search ?

mjlsnombrado — Tue, 12 Dec 2017 01:49:57 GMT

I have the same problem, do I need to use a script to fix this issue? If yes, what kind of script should I use?