Splunk Search

Get unique values from with in a field.

sanchitlohia
Explorer

I have a splunk entry like this

url="11111/toy/{toy_id}/part/{part_id}"

Here toy_id and part_id are six digit numbers.

How do I write my splunk query so that I get results only with unique toy_id.

Thanks for your help.

Tags (1)
0 Karma

somesoni2
Revered Legend

By "Only with unique toy_id", do you mean get one results per toy_id (so all events have unique toy_id) or get result with toy_id which have appeared only once?

0 Karma

wpreston
Motivator

If toy_id is already extracted, you could use this:

... your base search ... | dedup toy_id | ... rest of your search ...

If toy_id is not extracted as a field, you could use this:

... your base search ... | rex "url="\d+\/.+?\/{(?<toy_id>[^}]+)" | dedup toy_id | ... rest of your search ...
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...