https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136819#M37437 <P>You could do something like this:</P> <P>index=<EM>ind</EM> source=src1.log Name=* info=HIGH | table Name | evenstats count by Name | search count&gt;1</P> Thu, 12 Feb 2015 18:38:21 GMT jhupka 2015-02-12T18:38:21Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136816#M37434 <P>Basically I have a field "Name" and I want to keep all events with duplicate "Name"s. So exactly the opposite of dedup.</P> <P>Is this possible?</P> <P>Edit:<BR /> I have a bunch of events that each have a field "Name". I want to eliminate any events that do not share a "Name" with another event.<BR /> My search is fairly simple besides this. It looks something like: <CODE>index=*ind* source=src1.log Name=* info=HIGH | table Name</CODE></P> <P>In my stats table, I only want names that appear more than once.</P> Thu, 12 Feb 2015 18:18:31 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136816#M37434 rlough 2015-02-12T18:18:31Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136817#M37435 <P>Not sure this question is clear enough. Do you want events that have Name more than once? What have you tried so far? Can you share an example of your search?</P> Thu, 12 Feb 2015 18:24:05 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136817#M37435 bobbyfaber 2015-02-12T18:24:05Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136818#M37436 <P>I updated my question to be more clear, sorry!</P> Thu, 12 Feb 2015 18:28:21 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136818#M37436 rlough 2015-02-12T18:28:21Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136819#M37437 <P>You could do something like this:</P> <P>index=<EM>ind</EM> source=src1.log Name=* info=HIGH | table Name | evenstats count by Name | search count&gt;1</P> Thu, 12 Feb 2015 18:38:21 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136819#M37437 jhupka 2015-02-12T18:38:21Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136820#M37438 <P>Sweet, thanks!</P> Thu, 12 Feb 2015 18:43:01 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-opposite-to-dedup/m-p/136820#M37438 rlough 2015-02-12T18:43:01Z