many events for each user - how to see only one event from each user?

[rechteklebe]

Hello together,

i would like to see in a search the amount of affected user. Sometimes there are more events related to one user (e.g. user=12345).

I search for example for: index=123 ERROR user=*

Now i would like to see the amount of user who are affected. How can i not showing duplicate events of one user. I would like to see only one event from each user.

e.g

There are 7 events for user=12345

There are 7 events for user=23456



--> I would like to see only:

1 event for user 12345

1 event for user 23456

Please help me.

Thank you in advance!

[Ayn · Accepted solution]

Use dedup.

... | dedup user

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Dedup