https://community.splunk.com/t5/Splunk-Search/Which-value-does-the-dedup-command-keep/m-p/71492#M17880 <P>The dedup command will return the first key value found for that particular field. This means the most recent in time, as splunk searches from latest to earliest. For example, in the search that dedups the ip_address value for your firewall log, you will see the most recent ip_address that has been logged to that source.</P> <P>For more detail: <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup" rel="nofollow">http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup</A></P> Sat, 16 Oct 2010 02:15:41 GMT Simeon 2010-10-16T02:15:41Z https://community.splunk.com/t5/Splunk-Search/Which-value-does-the-dedup-command-keep/m-p/71491#M17879 <P>I am running the dedup command for my ip_address field and I want to know the value returned by the command. Is it the last value seen, first value seen, something random? My search looks like this;</P> <PRE><CODE>sourcetype=firewall_log | dedup ip_address </CODE></PRE> Sat, 16 Oct 2010 02:14:35 GMT https://community.splunk.com/t5/Splunk-Search/Which-value-does-the-dedup-command-keep/m-p/71491#M17879 Simeon 2010-10-16T02:14:35Z https://community.splunk.com/t5/Splunk-Search/Which-value-does-the-dedup-command-keep/m-p/71492#M17880 <P>The dedup command will return the first key value found for that particular field. This means the most recent in time, as splunk searches from latest to earliest. For example, in the search that dedups the ip_address value for your firewall log, you will see the most recent ip_address that has been logged to that source.</P> <P>For more detail: <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup" rel="nofollow">http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup</A></P> Sat, 16 Oct 2010 02:15:41 GMT https://community.splunk.com/t5/Splunk-Search/Which-value-does-the-dedup-command-keep/m-p/71492#M17880 Simeon 2010-10-16T02:15:41Z