topic Re: Dedup all redundant data in a column...having an issue in Splunk Search

Dedup all redundant data in a column...having an issue

infra2sec — Tue, 29 Sep 2020 10:14:13 GMT

I am new and learning Splunk.

I created a search where multiple time stamps are revealed in a column. I'd just like that time stamp to show up once in my search results.

I tried using Dedup, but it takes all of the date time stamps away.

The search listed below works the way I want it to with that exception.

Thanks!

Re: Dedup all redundant data in a column...having an issue

infra2sec — Thu, 14 Jul 2016 12:42:18 GMT

Title should have read "........Dedup all redundant data in a column...having an issue"

Re: Dedup all redundant data in a column...having an issue

infra2sec — Thu, 14 Jul 2016 12:42:18 GMT

Title should have read "........Dedup all redundant data in a column...having an issue"

Re: Dedup all redundant data in a column...having an issue

javiergn — Thu, 14 Jul 2016 12:47:44 GMT

I have edit your title as per the comment above

Re: Dedup all redundant data in a column...having an issue

gcusello — Tue, 29 Sep 2020 10:12:49 GMT

you could do something like this
index=xyz sourcetype="xyz:xyz:xyz" | eval Date =strftime(_time, "%Y%m%d") | dedup Date | table Date | rename Date as "Date that something happened"
OR
index=xyz sourcetype="xyz:xyz:xyz" | eval Date =strftime(_time, "%Y%m%d") | stats count by Date | rename Date as "Date that something happened"
repeting table two times is more slow and not mandatory.
Bye.
Giuseppe

Re: Dedup all redundant data in a column...having an issue

infra2sec — Thu, 14 Jul 2016 12:49:20 GMT

Thank you very much. Is there a way to do that myself? I searched and didn't find a way.

Thanks

Re: Dedup all redundant data in a column...having an issue

sundareshr — Thu, 14 Jul 2016 13:00:18 GMT

Try this

index=xyz sourcetype="xyz:xyz:xyz" | timechart span=1d count | eval "Date that something happened"=strftime(_time, "%Y%m%d") | table "Date that something happened"

Re: Dedup all redundant data in a column...having an issue

Stevelim — Thu, 14 Jul 2016 15:56:43 GMT

Hey, to list out unique values, you should look into stats command as well

Base search to filter out the correct events | table_time | eval Date =strftime(_time, "%Y%m%d") | stats list(Date)

Here's an example:

index=* Value>60 | eval Date = strftime(_time, "%Y%m%d") | stats values(Date) as Date | mvexpand Date

Re: Dedup all redundant data in a column...having an issue

woodcock — Fri, 15 Jul 2016 21:46:20 GMT

Get more Karma:

http://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/WhatisKarma
http://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/HowtoearnKarma

Re: Dedup all redundant data in a column...having an issue

woodcock — Fri, 15 Jul 2016 21:53:59 GMT

Like this:

index=xyz sourcetype="xyz:xyz:xyz" | bucket span=1d _time | dedup _time | rename _time AS "Date that something happened"

Re: Dedup all redundant data in a column...having an issue

infra2sec — Mon, 18 Jul 2016 17:37:44 GMT

You all are awesome. Starting to get the results that I need. Wanted to report back, but I could only post 2 times per day.