Dashboards & Visualizations

How to only display unique values from a field?

lordhans
Explorer

I am searching the my logs for key IDs that can either be from group 'AA' or group 'BB'. I find them by using rex and then display them in a table. (AA_12345 for example).

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | table id

Some of those key IDs are duplicates. I only want to show unique key IDs in the table. How can I do this? Based on some posts I found on here there is something called 'dedup' that might be useful here but I can't figure out where I'd insert it in my search query.

Any help is appreciated, thanks!

Tags (1)
1 Solution

somesoni2
Revered Legend

Try like this

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | table id | dedup id

OR (stats will remove duplicates as well)

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | stats count by id | table id

View solution in original post

somesoni2
Revered Legend

Try like this

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | table id | dedup id

OR (stats will remove duplicates as well)

"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\d+)|(BB_\d+))" | stats count by id | table id
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...