Splunk Search

How do i get Unique events for my search keyword

rakesh_498115
Motivator

I am getting so many results for a single search keyword.how do i make a unique single result for that search keyword.

for example if i am search like this ..

sourcetype="A" xyz

i am getting differnt results that contain "xyz" ..due to duplicate source files in my index.
i need to display only the unique event of the search parameter .. how can i do tat ?? thanx...

Tags (1)
0 Karma

hchinta
Explorer

base search... |dedup source

0 Karma

kristian_kolb
Ultra Champion

The problem is that xyz is just a free text search, as opposed to some_parameter=xyz, which is more precise.

Always try to minimize the the time span over which you're searching.

If you have duplicates, try using ... | dedup _raw

/k

Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...