Delete duplicate events

[kml_uvce]

I want to delete duplicate events means want only one event and other same event should be deleted.

[gooza · Accepted solution]

also there is a newer script by zpavic:

see his answer to my question : link:remove duplicates on specific dates

[MuS]

Hi kml_uvce

the answer from gooza is a good one, he links to an app which you download and install into your splunk. afterwards you can run the script remove_duplicate_event.py which will '| delete' the duplicates.

This will not really delete but make the result unsearchable so you will get single results rather then duplicates, read more here

cheers

[gooza]

try this :

http://splunk-base.splunk.com/apps/22899/remove-duplicate-event-data-from-index

[Ayn]

Well the script is in that app gooza references. Download it and figure out stuff for yourself. We're here to help but you need to do some work on your own as well.

[kml_uvce]

First thing I am not seeing any script remove_duplicate_event.py in splunk and second this will delete all events ? I want to keep one event