- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Elimination of duplicate logins over time
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My problem is that in my data source, when a user logs on there can be a single entry or multiple entries. I need to eliminate the duplicates for each time interval but allow for future events by that User ID. I have tried dedup and distinct count. Does anyone have any suggestions?
index=* prdwfcs*/88 WFCSUID=UserID | stats count dc(WFCSUID)
index=* prdwfcs*/88 WFCSUID=UserID | dedup WFCSUID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the duplicates have same timestamp and other entries from that User Id are different, dedup of _time should do the job for you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the duplicates have same timestamp and other entries from that User Id are different, dedup of _time should do the job for you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just took care of it @Jeff_Lightly_Splunk 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If possible, consider marking somesoni2's comment as an answer and accepting that answer. This will help others who may have similar issues in the future and it helps spread karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you somesoni2. dedup by _time did solve my issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, they have the same time stamp. I had not thought of it from that aspect. Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does the multiple/duplicate login entries have same time stamp? Could you post some sample of duplicate entries?
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
