Splunk Search

How to dedup in a search with a Lookup table?

earriaga
Path Finder

I have a working search that uses a look up, that is like this:

index=MyIndex

  [| inputlookup MyCSVFile

    | stats values(email) AS EmailAddress

    | format]

|chart count(Code) as NumCodes  over EmailAddress |sort -NumCodes

This works, but there are duplicate codes, so i want the search to count only unique codes per user.

I am not sure how to say Count Unique.

Thank you for your help!!

 

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk uses "distinct_count" for Count Unique.

index=MyIndex
  [| inputlookup MyCSVFile
   | stats values(email) AS EmailAddress
   | format]
| chart distinct_count(Code) as NumCodes  over EmailAddress 
| sort - NumCodes
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Splunk uses "distinct_count" for Count Unique.

index=MyIndex
  [| inputlookup MyCSVFile
   | stats values(email) AS EmailAddress
   | format]
| chart distinct_count(Code) as NumCodes  over EmailAddress 
| sort - NumCodes
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...