https://community.splunk.com/t5/Splunk-Search/normalising-duplicate-multivalue-field/m-p/81524#M20661 <P>There really isn't an easy way globally.</P> <P>In general, you might look at:</P> <UL> <LI>Using app namespaces to control when particular extractions are performed. If some are only needed in certain contexts, then perhaps these contexts could be separated out into their own app to avoid this kind of conflict</LI> <LI>Making the regexes more precise and/or combining multiple regexes into a single one that retrieves multiple fields</LI> </UL> Thu, 14 Apr 2011 11:02:00 GMT gkanapathy 2011-04-14T11:02:00Z https://community.splunk.com/t5/Splunk-Search/normalising-duplicate-multivalue-field/m-p/81523#M20660 <P>so i have numerous field extractions in place. unfortunately due to the number of regex's there are some events that match two field extractions. the issue is that i have the same field name defined in both extractions.</P> <P>this isn't a problem as splunk is nice enough to create a multivalue field for me automatically. it just so happens that the value of that field is the same for both entries!</P> <P>is there a way i can reduce/normalise this so it doesn't show twice? (without reconstructing my regex's)</P> Thu, 14 Apr 2011 08:07:10 GMT https://community.splunk.com/t5/Splunk-Search/normalising-duplicate-multivalue-field/m-p/81523#M20660 ytl 2011-04-14T08:07:10Z https://community.splunk.com/t5/Splunk-Search/normalising-duplicate-multivalue-field/m-p/81524#M20661 <P>There really isn't an easy way globally.</P> <P>In general, you might look at:</P> <UL> <LI>Using app namespaces to control when particular extractions are performed. If some are only needed in certain contexts, then perhaps these contexts could be separated out into their own app to avoid this kind of conflict</LI> <LI>Making the regexes more precise and/or combining multiple regexes into a single one that retrieves multiple fields</LI> </UL> Thu, 14 Apr 2011 11:02:00 GMT https://community.splunk.com/t5/Splunk-Search/normalising-duplicate-multivalue-field/m-p/81524#M20661 gkanapathy 2011-04-14T11:02:00Z https://community.splunk.com/t5/Splunk-Search/normalising-duplicate-multivalue-field/m-p/81525#M20662 <P>oh well... back to restructuring my regex's i guess... just a thought, when i do a top on such a field - would it double count? cheers,</P> Fri, 15 Apr 2011 02:21:41 GMT https://community.splunk.com/t5/Splunk-Search/normalising-duplicate-multivalue-field/m-p/81525#M20662 ytl 2011-04-15T02:21:41Z