https://community.splunk.com/t5/Splunk-Search/help-with-splunk-dedup/m-p/133191#M36369 <P>Hello, please help me. How I can dedup this:</P> <PRE><CODE>Jul 8 07:58:01 host crond[7597]: pam_unix(crond:account): password for user post_sender will expire in 2 days Jul 8 07:56:01 host crond[7595]: pam_unix(crond:account): password for user post_sender will expire in 2 days Jul 8 07:55:01 host crond[7586]: pam_unix(crond:account): password for user post_sender will expire in 2 days Jul 8 07:54:01 host crond[7540]: pam_unix(crond:account): password for user post_sender will expire in 2 days Jul 8 07:52:01 host crond[7486]: pam_unix(crond:account): password for user post_sender will expire in 2 days </CODE></PRE> <P>I tried to make dedup _raw but they differ on timestamp</P> Tue, 08 Jul 2014 07:45:58 GMT vinchakov_a 2014-07-08T07:45:58Z https://community.splunk.com/t5/Splunk-Search/help-with-splunk-dedup/m-p/133191#M36369 <P>Hello, please help me. How I can dedup this:</P> <PRE><CODE>Jul 8 07:58:01 host crond[7597]: pam_unix(crond:account): password for user post_sender will expire in 2 days Jul 8 07:56:01 host crond[7595]: pam_unix(crond:account): password for user post_sender will expire in 2 days Jul 8 07:55:01 host crond[7586]: pam_unix(crond:account): password for user post_sender will expire in 2 days Jul 8 07:54:01 host crond[7540]: pam_unix(crond:account): password for user post_sender will expire in 2 days Jul 8 07:52:01 host crond[7486]: pam_unix(crond:account): password for user post_sender will expire in 2 days </CODE></PRE> <P>I tried to make dedup _raw but they differ on timestamp</P> Tue, 08 Jul 2014 07:45:58 GMT https://community.splunk.com/t5/Splunk-Search/help-with-splunk-dedup/m-p/133191#M36369 vinchakov_a 2014-07-08T07:45:58Z https://community.splunk.com/t5/Splunk-Search/help-with-splunk-dedup/m-p/133192#M36370 <P>Hello</P> <P>Maybe you´ll prefer to use the cluster command</P> <PRE><CODE><A href="http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Cluster" target="test_blank">http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Cluster</A> </CODE></PRE> <P>Regards</P> Tue, 08 Jul 2014 07:50:39 GMT https://community.splunk.com/t5/Splunk-Search/help-with-splunk-dedup/m-p/133192#M36370 gfuente 2014-07-08T07:50:39Z https://community.splunk.com/t5/Splunk-Search/help-with-splunk-dedup/m-p/133193#M36371 <P>thnx!! good</P> Tue, 08 Jul 2014 10:13:37 GMT https://community.splunk.com/t5/Splunk-Search/help-with-splunk-dedup/m-p/133193#M36371 vinchakov_a 2014-07-08T10:13:37Z