topic Extract events where same key-value pair exist more than 1 time in Splunk Search https://community.splunk.com/t5/Splunk-Search/Extract-fields-with-specific-value-where-multiple-combination-of/m-p/702102#M238107 <P>I've an event looks like below. The Key value pair of "test:22345" exists more than 1 time and I need only this events in the output as table or count of events.<BR /><BR /></P> <LI-CODE lang="markup">{"test":"22345","testType":"model"},{"test":"22345","testType":"model1"},{"test":"22345","testType":"model2"}</LI-CODE> Wed, 16 Oct 2024 18:02:29 GMT Deprasad 2024-10-16T18:02:29Z Extract fields with specific value where multiple combination of "value" exists for same "Key" https://community.splunk.com/t5/Splunk-Search/Extract-fields-with-specific-value-where-multiple-combination-of/m-p/702103#M238104 <P>I've the below event, where I need to display only event which has action=test and category=testdata.<BR /><BR /></P> <LI-CODE lang="markup">test { line1: 1 "action": "test", "category": "testdata", } test1 { line1: 1 "action": "event", "category": "testdata", } test2 { line1: 1 "action": "test", "category": "duplicate_data", }</LI-CODE> Wed, 16 Oct 2024 18:03:08 GMT https://community.splunk.com/t5/Splunk-Search/Extract-fields-with-specific-value-where-multiple-combination-of/m-p/702103#M238104 Deprasad 2024-10-16T18:03:08Z Extract events where same key-value pair exist more than 1 time https://community.splunk.com/t5/Splunk-Search/Extract-fields-with-specific-value-where-multiple-combination-of/m-p/702102#M238107 <P>I've an event looks like below. The Key value pair of "test:22345" exists more than 1 time and I need only this events in the output as table or count of events.<BR /><BR /></P> <LI-CODE lang="markup">{"test":"22345","testType":"model"},{"test":"22345","testType":"model1"},{"test":"22345","testType":"model2"}</LI-CODE> Wed, 16 Oct 2024 18:02:29 GMT https://community.splunk.com/t5/Splunk-Search/Extract-fields-with-specific-value-where-multiple-combination-of/m-p/702102#M238107 Deprasad 2024-10-16T18:02:29Z Re: Extract fields with specific value where multiple combination of "value" exists for same "Key" https://community.splunk.com/t5/Splunk-Search/Extract-fields-with-specific-value-where-multiple-combination-of/m-p/702104#M238105 <P>What have you tried so far?</P> Wed, 16 Oct 2024 17:54:34 GMT https://community.splunk.com/t5/Splunk-Search/Extract-fields-with-specific-value-where-multiple-combination-of/m-p/702104#M238105 ITWhisperer 2024-10-16T17:54:34Z Re: Extract fields with specific value where multiple combination of "value" exists for same "Key" https://community.splunk.com/t5/Splunk-Search/Extract-fields-with-specific-value-where-multiple-combination-of/m-p/702110#M238106 <P>If this is a verbatim copy of your original event you have much more problems with your data.</P> Wed, 16 Oct 2024 19:23:01 GMT https://community.splunk.com/t5/Splunk-Search/Extract-fields-with-specific-value-where-multiple-combination-of/m-p/702110#M238106 PickleRick 2024-10-16T19:23:01Z