Splunk Search

Getting unique values of a field.

splunkpoornima
Communicator

Hi all. I have a field called TaskAction that has some 400 values. But, I only want the distinct values of that field.

Plz help me with the query.

Labels (1)
Tags (1)
1 Solution

Ayn
Legend

There's dedup, and there's also the stats operator values.

View solution in original post

bbialek
Path Finder

This seems to work when trying to find unique values for a field, like 'host':
* | chart count by host

Ayn
Legend

There's dedup, and there's also the stats operator values.

andrewb_splunk
Splunk Employee
Splunk Employee

The Splunk Enterprise version 5.0 documentation from 2012 is no longer available. Similar information is available in newer versions of the Splunk documentation. Replace "5.0" in the URL with "latest" or a more recent version number to view the topics. 

dedup: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dedup 

stats: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions 

0 Karma

slierninja
Communicator

stats values(field) is what I used.

Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...