https://community.splunk.com/t5/Splunk-Search/deduping-one-field-by-another-field/m-p/231793#M68756 <P>Hi ajdyer2000,</P> <P>you can try <CODE>stats</CODE> and the <CODE>values()</CODE> option:</P> <PRE><CODE>your base search here | stats count values(server_name) AS server_name BY userid | fields - count </CODE></PRE> <P>Hope this helps to get you started ...</P> <P>cheers, MuS</P> Sat, 19 Sep 2015 19:20:14 GMT MuS 2015-09-19T19:20:14Z https://community.splunk.com/t5/Splunk-Search/deduping-one-field-by-another-field/m-p/231792#M68755 <P>Hi </P> <P>I'm very new to Splunk so hopefully this is an easy one.</P> <P>I have 2 Fields server_name and userid. I would like to remove duplicates from the "userid" field while keeping the values of "server_name"</P> <P>for example</P> <P>Search results</P> <P>server1, user1<BR /> server1, user2<BR /> server1, user2<BR /> server1, user3<BR /> server1, user4<BR /> server2, user1<BR /> server2, user1<BR /> server2, user1<BR /> server2 user2<BR /> server2, user3<BR /> server2, user4<BR /> server2, user4</P> <P>What I would like the results to be:</P> <P>server1, user1<BR /> server1, user2<BR /> server1, user3<BR /> server1, user4<BR /> server2, user1<BR /> server2 user2<BR /> server2, user3<BR /> server2, user4</P> <P>Thanks</P> Tue, 29 Sep 2020 07:18:54 GMT https://community.splunk.com/t5/Splunk-Search/deduping-one-field-by-another-field/m-p/231792#M68755 ajdyer2000 2020-09-29T07:18:54Z https://community.splunk.com/t5/Splunk-Search/deduping-one-field-by-another-field/m-p/231793#M68756 <P>Hi ajdyer2000,</P> <P>you can try <CODE>stats</CODE> and the <CODE>values()</CODE> option:</P> <PRE><CODE>your base search here | stats count values(server_name) AS server_name BY userid | fields - count </CODE></PRE> <P>Hope this helps to get you started ...</P> <P>cheers, MuS</P> Sat, 19 Sep 2015 19:20:14 GMT https://community.splunk.com/t5/Splunk-Search/deduping-one-field-by-another-field/m-p/231793#M68756 MuS 2015-09-19T19:20:14Z https://community.splunk.com/t5/Splunk-Search/deduping-one-field-by-another-field/m-p/231794#M68757 <P>Looking at your results, actually you should know that <A href="http://docs.splunk.com/Documentation/Splunk/6.2.6/SearchReference/dedup">dedup</A> can take multiple fields in which case you wind up with all unique sets of fields:</P> <PRE><CODE>base search | dedup server_name, userid </CODE></PRE> <P>To try this out you could mock up your example data, with a base search like:</P> <PRE><CODE>| noop | stats count | eval raw = split("server1,user1;server1,user2;server1,user2;server1,user3;server1,user4;server2,user1;server2,user1;server2,user1;server2,user2;server2,user3;server2,user4;server2,user4",";") | mvexpand raw | eval server=mvindex(split(raw,","),0) | eval user=mvindex(split(raw,","),1) | fields server,user </CODE></PRE> <P>Then compare the result to:</P> <PRE><CODE>| noop | stats count | eval raw = split("server1,user1;server1,user2;server1,user2;server1,user3;server1,user4;server2,user1;server2,user1;server2,user1;server2,user2;server2,user3;server2,user4;server2,user4",";") | mvexpand raw | eval server=mvindex(split(raw,","),0) | eval user=mvindex(split(raw,","),1) | fields server,user | dedup server_name, userid </CODE></PRE> Sat, 19 Sep 2015 19:37:41 GMT https://community.splunk.com/t5/Splunk-Search/deduping-one-field-by-another-field/m-p/231794#M68757 acharlieh 2015-09-19T19:37:41Z