Archive
Highlighted

Delete duplicate events

Builder

I want to delete duplicate events means want only one event and other same event should be deleted.

Tags (1)
Highlighted

Re: Delete duplicate events

Communicator
Highlighted

Re: Delete duplicate events

Builder

First thing I am not seeing any script removeduplicateevent.py in splunk and second this will delete all events ? I want to keep one event

0 Karma
Highlighted

Re: Delete duplicate events

Legend

Well the script is in that app gooza references. Download it and figure out stuff for yourself. We're here to help but you need to do some work on your own as well.

0 Karma
Highlighted

Re: Delete duplicate events

SplunkTrust
SplunkTrust

Hi kml_uvce

the answer from gooza is a good one, he links to an app which you download and install into your splunk. afterwards you can run the script remove_duplicate_event.py which will '| delete' the duplicates.

This will not really delete but make the result unsearchable so you will get single results rather then duplicates, read more here

cheers

0 Karma
Highlighted

Re: Delete duplicate events

Communicator

also there is a newer script by zpavic:

see his answer to my question : link:remove duplicates on specific dates

View solution in original post