Splunk Search

Help with query

New Member

Hello - I am new to splunk and am trying to do a search on data that calls out three different fields for duplicates so I can make a report out of that. Two of the fields are the name and serial number, and the third field is the name and serial number combined. Any help is appreciated, thanks.

Labels (2)
0 Karma


What exactly do you mean by duplicates? A value that appears more than once in a given field (column)? Or a combined set of values from all fields?

0 Karma


Without understanding the data, or the search your working with...

| your search
| stats count by name, serial_number, name_number
| search count>1

Any records that have identical names/serial number will show up.  You can adjust this as follows:

| your search
| stats count as count, values(serial_number) as serial_number, values(name_number) by name,
| search count>1

That would show if there we hosts with the same name, but might have different serial numbers. 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!