Splunk Search

Help with query

dmtman
New Member

Hello - I am new to splunk and am trying to do a search on data that calls out three different fields for duplicates so I can make a report out of that. Two of the fields are the name and serial number, and the third field is the name and serial number combined. Any help is appreciated, thanks.

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

What exactly do you mean by duplicates? A value that appears more than once in a given field (column)? Or a combined set of values from all fields?

0 Karma

solarboyz1
Builder

Without understanding the data, or the search your working with...

| your search
| stats count by name, serial_number, name_number
| search count>1

Any records that have identical names/serial number will show up.  You can adjust this as follows:

| your search
| stats count as count, values(serial_number) as serial_number, values(name_number) by name,
| search count>1

That would show if there we hosts with the same name, but might have different serial numbers. 


0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

Stay Connected: Your Guide to August Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Unleash the Power of Splunk MCP and AI, Meet Us at .Conf 2025, and Find Even More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...