https://community.splunk.com/t5/Splunk-Search/Merging-two-log-line/m-p/104383#M27041 <P>that's right but for splunk using uniq worked..thanks</P> Fri, 04 Nov 2011 19:59:17 GMT keshab 2011-11-04T19:59:17Z https://community.splunk.com/t5/Splunk-Search/Merging-two-log-line/m-p/104381#M27039 <P>I have two log line with the same information. How can I do search so that it displays just one log??</P> <P>For e.g.</P> <P>2011-11-04 10:20:48,476 [WARN ] RemoteIpAddress: X.X.X.X; SessionId: XXX; exception: Password or Wolfram ID entered was incorrect<BR /> 2011-11-04 10:20:48,476 [WARN ] RemoteIpAddress: X.X.X.X; SessionId: XXX; exception: Password or Wolfram ID entered was incorrect</P> <P>I want it to display one result instead of two.</P> Fri, 04 Nov 2011 16:50:18 GMT https://community.splunk.com/t5/Splunk-Search/Merging-two-log-line/m-p/104381#M27039 keshab 2011-11-04T16:50:18Z https://community.splunk.com/t5/Splunk-Search/Merging-two-log-line/m-p/104382#M27040 <P>I believe you want to investigate using the dedup command against a common field (possibly _raw). You should really fix the situation where it is logging multiple lines of the same content.</P> Fri, 04 Nov 2011 17:26:55 GMT https://community.splunk.com/t5/Splunk-Search/Merging-two-log-line/m-p/104382#M27040 Simeon 2011-11-04T17:26:55Z https://community.splunk.com/t5/Splunk-Search/Merging-two-log-line/m-p/104383#M27041 <P>that's right but for splunk using uniq worked..thanks</P> Fri, 04 Nov 2011 19:59:17 GMT https://community.splunk.com/t5/Splunk-Search/Merging-two-log-line/m-p/104383#M27041 keshab 2011-11-04T19:59:17Z