Getting Data In

How do we disable dupliacte events to display in the search results

rakesh_498115
Motivator

Hi

For Every Search Query i excute . I could see the list of the dupliate events associated with each search query . How can make them disable and display only the unique events associated with my search Query.

I am getting these duplicate events ..since accidently i got the source files indexed twice.I know i can i delete them...but i dnt want to delete..cause it may effect the other search queries..can you pls give me a solution to see the unique events for my search without deleting the dulicate source files...

thanx..

0 Karma
1 Solution

Ayn
Legend

Is both the sourcetype and source exactly the same? Otherwise, you could single out just one of the duplicated sources. Another option would to dedup by the _time or _raw fields.

View solution in original post

yannK
Splunk Employee
Splunk Employee

You can use the command | dedup to keep only one of them. In your case the field can be _raw.

" mysearch | dedup _raw | myotherthingstodolikestats"

0 Karma

Ayn
Legend

Is both the sourcetype and source exactly the same? Otherwise, you could single out just one of the duplicated sources. Another option would to dedup by the _time or _raw fields.

rakesh_498115
Motivator

Thanks .:)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...