Splunk Search

Get unique values from with in a field.

sanchitlohia
Explorer

I have a splunk entry like this

url="11111/toy/{toy_id}/part/{part_id}"

Here toy_id and part_id are six digit numbers.

How do I write my splunk query so that I get results only with unique toy_id.

Thanks for your help.

Tags (1)
0 Karma

somesoni2
Revered Legend

By "Only with unique toy_id", do you mean get one results per toy_id (so all events have unique toy_id) or get result with toy_id which have appeared only once?

0 Karma

wpreston
Motivator

If toy_id is already extracted, you could use this:

... your base search ... | dedup toy_id | ... rest of your search ...

If toy_id is not extracted as a field, you could use this:

... your base search ... | rex "url="\d+\/.+?\/{(?<toy_id>[^}]+)" | dedup toy_id | ... rest of your search ...
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...