Archive

Delete duplicate events

Builder

I want to delete duplicate events means want only one event and other same event should be deleted.

Tags (1)
1 Solution

Communicator

also there is a newer script by zpavic:

see his answer to my question : link:remove duplicates on specific dates

View solution in original post

Communicator

also there is a newer script by zpavic:

see his answer to my question : link:remove duplicates on specific dates

View solution in original post

SplunkTrust
SplunkTrust

Hi kml_uvce

the answer from gooza is a good one, he links to an app which you download and install into your splunk. afterwards you can run the script remove_duplicate_event.py which will '| delete' the duplicates.

This will not really delete but make the result unsearchable so you will get single results rather then duplicates, read more here

cheers

0 Karma

Communicator

Legend

Well the script is in that app gooza references. Download it and figure out stuff for yourself. We're here to help but you need to do some work on your own as well.

0 Karma

Builder

First thing I am not seeing any script removeduplicateevent.py in splunk and second this will delete all events ? I want to keep one event

0 Karma