https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171399#M49087 <P>Just took care of it <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/121885">@Jeff_Lightly_Sp</a>lunk <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 28 Sep 2020 17:17:45 GMT ppablo 2020-09-28T17:17:45Z https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171393#M49081 <P>My problem is that in my data source, when a user logs on there can be a single entry or multiple entries. I need to eliminate the duplicates for each time interval but allow for future events by that User ID. I have tried dedup and distinct count. Does anyone have any suggestions?</P> <PRE><CODE>index=* prdwfcs*/88 WFCSUID=UserID | stats count dc(WFCSUID) index=* prdwfcs*/88 WFCSUID=UserID | dedup WFCSUID </CODE></PRE> Tue, 05 Aug 2014 15:58:35 GMT https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171393#M49081 DonDandrea 2014-08-05T15:58:35Z https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171394#M49082 <P>Does the multiple/duplicate login entries have same time stamp? Could you post some sample of duplicate entries?</P> Tue, 05 Aug 2014 16:02:25 GMT https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171394#M49082 somesoni2 2014-08-05T16:02:25Z https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171395#M49083 <P>Yes, they have the same time stamp. I had not thought of it from that aspect. Thank you!</P> Tue, 05 Aug 2014 17:10:15 GMT https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171395#M49083 DonDandrea 2014-08-05T17:10:15Z https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171396#M49084 <P>If the duplicates have same timestamp and other entries from that User Id are different, dedup of _time should do the job for you.</P> Tue, 05 Aug 2014 17:15:57 GMT https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171396#M49084 somesoni2 2014-08-05T17:15:57Z https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171397#M49085 <P>Thank you somesoni2. dedup by _time did solve my issue.</P> Fri, 08 Aug 2014 14:48:32 GMT https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171397#M49085 DonDandrea 2014-08-08T14:48:32Z https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171398#M49086 <P>If possible, consider marking somesoni2's comment as an answer and accepting that answer. This will help others who may have similar issues in the future and it helps spread karma <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 08 Aug 2014 15:35:05 GMT https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171398#M49086 Jeff_Lightly_Sp 2014-08-08T15:35:05Z https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171399#M49087 <P>Just took care of it <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/121885">@Jeff_Lightly_Sp</a>lunk <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 28 Sep 2020 17:17:45 GMT https://community.splunk.com/t5/Splunk-Search/Elimination-of-duplicate-logins-over-time/m-p/171399#M49087 ppablo 2020-09-28T17:17:45Z