Splunk Search

Dedup command not working after using the stats list command

New Member

When I am running the following search:

index=main sourcetype="access_combined_wcookie"| stats list(useragent) as Browsers | dedup Browsers consecutive=true

The dedup command is not removing duplicate entries in the browser field.
Can someone explain to me why it is happening?

0 Karma


Did you try mvdedup?

index=main sourcetype="access_combined_wcookie"
| stats list(useragent) as Browsers
| eval Browsers=mvdedup(Browsers)
0 Karma


While using dedup on a table, splunk will deduplicate values (read cells) of a given field. Your result has a single value/cell (regardless of having multiple values inside it) so there is nothing to dedup.

What you're probably looking for is something like:
index=main sourcetype="access_combined_wcookie"| stats values(useragent) as Browsers


index=main sourcetype="access_combined_wcookie"| stats count by useragent

Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!