https://community.splunk.com/t5/Splunk-Search/DEDUP-with-Multiple-Values-not-Working/m-p/237444#M70569 <P>Give this a try</P> <PRE><CODE>your base search | eval PORT=coalesce(PORT,"NA") | dedup QID IP PORT </CODE></PRE> Tue, 05 Jul 2016 19:27:35 GMT somesoni2 2016-07-05T19:27:35Z https://community.splunk.com/t5/Splunk-Search/DEDUP-with-Multiple-Values-not-Working/m-p/237443#M70568 <P>I have vulnerability detection in Splunk where there is the possibility of duplicate QID, IP and PORT, so I run a search string to dedup QID IP PORT however it doesn't give me the values I want because some detection don't have a PORT associated.</P> <P>I try to add ... | fillnull PORT | dedup QID IP PORT | ... however the result is the same as when I don't do a dedup and I know for sure there are detection with all three as it's creating the descripances with the result we get from the Vulnerability scanner itself.</P> <P>How else can I make this work?</P> Mon, 04 Jul 2016 19:50:01 GMT https://community.splunk.com/t5/Splunk-Search/DEDUP-with-Multiple-Values-not-Working/m-p/237443#M70568 Makinde 2016-07-04T19:50:01Z https://community.splunk.com/t5/Splunk-Search/DEDUP-with-Multiple-Values-not-Working/m-p/237444#M70569 <P>Give this a try</P> <PRE><CODE>your base search | eval PORT=coalesce(PORT,"NA") | dedup QID IP PORT </CODE></PRE> Tue, 05 Jul 2016 19:27:35 GMT https://community.splunk.com/t5/Splunk-Search/DEDUP-with-Multiple-Values-not-Working/m-p/237444#M70569 somesoni2 2016-07-05T19:27:35Z https://community.splunk.com/t5/Splunk-Search/DEDUP-with-Multiple-Values-not-Working/m-p/237445#M70570 <P>No luck, still not working. Any other ideas?</P> Wed, 13 Jul 2016 14:47:55 GMT https://community.splunk.com/t5/Splunk-Search/DEDUP-with-Multiple-Values-not-Working/m-p/237445#M70570 Makinde 2016-07-13T14:47:55Z https://community.splunk.com/t5/Splunk-Search/DEDUP-with-Multiple-Values-not-Working/m-p/237446#M70571 <P>How about this</P> <PRE><CODE> your base search | eventstats values(PORT) as port by QID IP | eval PORT=coalesce(PORT,port ) | dedup QID IP PORT </CODE></PRE> Wed, 13 Jul 2016 15:01:50 GMT https://community.splunk.com/t5/Splunk-Search/DEDUP-with-Multiple-Values-not-Working/m-p/237446#M70571 somesoni2 2016-07-13T15:01:50Z