Splunk Search

How to dedup in a search with a Lookup table?

earriaga
Path Finder

I have a working search that uses a look up, that is like this:

index=MyIndex

  [| inputlookup MyCSVFile

    | stats values(email) AS EmailAddress

    | format]

|chart count(Code) as NumCodes  over EmailAddress |sort -NumCodes

This works, but there are duplicate codes, so i want the search to count only unique codes per user.

I am not sure how to say Count Unique.

Thank you for your help!!

 

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk uses "distinct_count" for Count Unique.

index=MyIndex
  [| inputlookup MyCSVFile
   | stats values(email) AS EmailAddress
   | format]
| chart distinct_count(Code) as NumCodes  over EmailAddress 
| sort - NumCodes
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Splunk uses "distinct_count" for Count Unique.

index=MyIndex
  [| inputlookup MyCSVFile
   | stats values(email) AS EmailAddress
   | format]
| chart distinct_count(Code) as NumCodes  over EmailAddress 
| sort - NumCodes
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...