topic Re: Distinct values in Splunk Search

Distinct values

SplnkUse — Wed, 01 Dec 2021 23:30:58 GMT

Hello

I am running a * search in an app and it returns several columns in the csv extract where a column is named 'source'.

I want to return the distinct values of 'source' but neither of the below work:

| values(source)

| distinct source

Any idea?

thanks!

ITWhisperer — Wed, 01 Dec 2021 23:47:25 GMT

| dedup source

yuanliu — Thu, 02 Dec 2021 08:00:03 GMT

I want to return the distinct values of 'source' but neither of the below work:
| values(source)
or
| distinct source

values and distinct are not commands. Have you tried stats?

| stats values(source) dc(source)