Splunk Search

Dedup command not working after using the stats list command

kmrkunal
New Member

When I am running the following search:

index=main sourcetype="access_combined_wcookie"| stats list(useragent) as Browsers | dedup Browsers consecutive=true

The dedup command is not removing duplicate entries in the browser field.
Can someone explain to me why it is happening?

0 Karma

nareshinsvu
Builder

Did you try mvdedup?

index=main sourcetype="access_combined_wcookie"
| stats list(useragent) as Browsers
| eval Browsers=mvdedup(Browsers)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

While using dedup on a table, splunk will deduplicate values (read cells) of a given field. Your result has a single value/cell (regardless of having multiple values inside it) so there is nothing to dedup.

What you're probably looking for is something like:
index=main sourcetype="access_combined_wcookie"| stats values(useragent) as Browsers

OR

index=main sourcetype="access_combined_wcookie"| stats count by useragent

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...