- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SPL query to find dublicate records injected to Splunk
Alankrit
New Member
08-26-2024
11:50 PM
Hi Team,
One of our customer reported that he was finding duplicate records in splunk ( duplicate files and duplicate data in files). We want to simulate the scenario in our lab. If someone can help to write SPL to find duplicate records.
Regards,
Alankrit
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
VatsalJagani

SplunkTrust
08-27-2024
07:29 AM
@Alankrit- Below is the search you can use. But just to clarify few points:
- This search is not very efficient and do not meant for reporting and only meant for troubleshooting purposes so you can find the source of duplicate events.
index=* sourcetype=* host=* | stats count by index, sourcetype, host, _raw | where count>1
I hope this helps!!! Kindly upvote if it does!!!
