How to filter duplicate KV entries?

[RHogg]

Hi guys,

I was wondering if someone could point me in the right direction with an issue I've been having.

Basically I have a search thats set to pull usernames from a KV lookup, the issue is theres "duplicate" entries in the lookup e.g.
Username and Username@email

Is there any way to stop the duplicate users from appearing in the search results? I seem to be at a bit of a dead end.

Thanks

[richgalloway · Accepted solution]

Those are not duplicates. If you want to filter out similar results then you need to modify your search to normalize the data. For example:

... | eval username = replace(username, "@.*", "")

[RHogg]

Just what I needed Rich, thanks very much! 🙂