topic Re: Keep transactions without duplicates without TRANSACTION or DEDUP in Splunk Search

Keep transactions without duplicates without TRANSACTION or DEDUP

splunked38 — Fri, 25 Sep 2015 10:55:40 GMT

Hi,

I'm currently using the expensive transaction command to keep transactions without any duplicates.

So if I had
a
b
c
c
d
d
d

this would return
a
b

sourcetype... | transaction name keepevicted=true | search eventcount=1

I'm trying to use:

search sourcetype=... | streamstats count by name

Which will give me a new field 'count' however I can't use where count>1 as one of the duplicates still remain.
I've hit a mental block, any ideas?

Can't use dedup for the same problem, one instance will still remain.

Thanks in advance.

somesoni2 — Fri, 25 Sep 2015 15:04:38 GMT

Here you go

your base search | eventstats count by name | where count=1

splunked38 — Mon, 28 Sep 2015 07:52:24 GMT

Thanks but sorry, this does not meet the spec.

If a duplicate is found, remove all entries.