Splunk Search

Distinct values

SplnkUse
Path Finder

Hello

 

I am running a * search in an app and it returns several columns in the csv extract where a column is named 'source'.

 

I want to return the distinct values of 'source' but neither of the below work:

| values(source)

or

| distinct source

 

Any idea?

 

thanks!

Labels (2)
Tags (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

I want to return the distinct values of 'source' but neither of the below work:

| values(source)

or

| distinct source

values and distinct  are not  commands.  Have you tried stats?

| stats values(source) dc(source)

 

View solution in original post

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I want to return the distinct values of 'source' but neither of the below work:

| values(source)

or

| distinct source

values and distinct  are not  commands.  Have you tried stats?

| stats values(source) dc(source)

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| dedup source
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...