topic Re: Search for Duplicate RecordNumbers in Splunk Search

Search for Duplicate RecordNumbers

rmcdougal — Mon, 13 Aug 2012 16:39:00 GMT

Basically, I want to create a search that will alert me in a forwarder is indexing the same data multiple times. We currently have a few that are and I want to see how many others are doing the same thing. So what I want is a search that will return the hostname of PC's that are indexing events with the same RecordNumber on the same day. I can't figure out how to accomplish it.

Re: Search for Duplicate RecordNumbers

ziegfried — Mon, 13 Aug 2012 17:02:34 GMT

Assuming that the RecordNumber is an extracted field, you could use such a search to list all host having multiple occurrences of the same RecordNumber on a single day:

RecordNumber=* | eval day=strftime(_time,"%Y%m%d") | stats count by host,day,RecordNumber | where count>0

Re: Search for Duplicate RecordNumbers

tiny3001 — Wed, 02 Apr 2014 10:16:26 GMT

I know I'm resurrecting something old here... but shouldn't it be '| where count>1'

We currently running into this problem, and yes, the search above is definitely the best way of finding duplicates