Getting Data In

How to find duplicate logs that contain uuids?

New Member

Hi, I want to know if there are more than one logs with the same message and the same uuid.

Eg:

  1. This an error for user with id: 1
  2. This an error for user with id: 2
  3. This an error for user with id: 1
  4. This an error for user with id: 3

I want to know if there are cases like 1 & 3 where the log is exactly the same but the user id is automatically generated.

0 Karma

Ultra Champion

Assuming you have the message and uuid extracted into fields already:

...
| eventstats count by message,uuid
| where count>1
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!