Dashboards & Visualizations

How to only display unique values from a field?

lordhans
Explorer

I am searching the my logs for key IDs that can either be from group 'AA' or group 'BB'. I find them by using rex and then display them in a table. (AA_12345 for example).

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | table id

Some of those key IDs are duplicates. I only want to show unique key IDs in the table. How can I do this? Based on some posts I found on here there is something called 'dedup' that might be useful here but I can't figure out where I'd insert it in my search query.

Any help is appreciated, thanks!

Tags (1)
1 Solution

somesoni2
Revered Legend

Try like this

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | table id | dedup id

OR (stats will remove duplicates as well)

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | stats count by id | table id

View solution in original post

somesoni2
Revered Legend

Try like this

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | table id | dedup id

OR (stats will remove duplicates as well)

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | stats count by id | table id
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...