Splunk Search

Consolidating table entries

dwear
Explorer

192.168.1.7 |table Realm, Role

I have a search and I'm trying to consolidate to unique combinations of Realm and Role.

 Realm         Role
 Realm A      Role A
 Realm A      Role A
 Realm A      Role A
 Realm A      Role B
 Realm A      Role A
 Realm B      Role B
 Realm B      Role C

As you can see above, there is duplicates. I tried "|dedup Realm" but I feel like its eliminating some unique combinations by eliminating duplicate Realms. I'd like see if look like this.

 Realm         Role
 Realm A      Role A
 Realm A      Role B
 Realm B      Role B
 Realm B      Role C
Tags (1)
0 Karma

Stevelim
Communicator
| stats values(Realm)  as Realm, values(Role)  as Role
0 Karma

woodcock
Esteemed Legend

Use 2 fields, like this:

192.168.1.7 | dedup Realm Role | table Realm Role
0 Karma

javiergn
Super Champion

Faster and nicer than dedup:

| stats count by Realm, Role
| fields - count
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...