Splunk Search

Help with query

New Member

Hello - I am new to splunk and am trying to do a search on data that calls out three different fields for duplicates so I can make a report out of that. Two of the fields are the name and serial number, and the third field is the name and serial number combined. Any help is appreciated, thanks.

Labels (2)
0 Karma


What exactly do you mean by duplicates? A value that appears more than once in a given field (column)? Or a combined set of values from all fields?

0 Karma


Without understanding the data, or the search your working with...

| your search
| stats count by name, serial_number, name_number
| search count>1

Any records that have identical names/serial number will show up.  You can adjust this as follows:

| your search
| stats count as count, values(serial_number) as serial_number, values(name_number) by name,
| search count>1

That would show if there we hosts with the same name, but might have different serial numbers. 

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...