Get unique values from with in a field.

[sanchitlohia]

I have a splunk entry like this

url="11111/toy/{toy_id}/part/{part_id}"

Here toy_id and part_id are six digit numbers.

How do I write my splunk query so that I get results only with unique toy_id.

Thanks for your help.

[somesoni2]

By "Only with unique toy_id", do you mean get one results per toy_id (so all events have unique toy_id) or get result with toy_id which have appeared only once?

[wpreston]

If toy_id is already extracted, you could use this:

... your base search ... | dedup toy_id | ... rest of your search ...

If toy_id is not extracted as a field, you could use this:

... your base search ... | rex "url="\d+\/.+?\/{(?<toy_id>[^}]+)" | dedup toy_id | ... rest of your search ...