Getting Data In

How to find duplicate logs that contain uuids?

nicolasmanic
New Member

Hi, I want to know if there are more than one logs with the same message and the same uuid.

Eg:

  1. This an error for user with id: 1
  2. This an error for user with id: 2
  3. This an error for user with id: 1
  4. This an error for user with id: 3

I want to know if there are cases like 1 & 3 where the log is exactly the same but the user id is automatically generated.

0 Karma

FrankVl
Ultra Champion

Assuming you have the message and uuid extracted into fields already:

...
| eventstats count by message,uuid
| where count>1
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...