Splunk Search

How to find duplicate field name within event?

dummy1281
Engager

My splunk entry is


firstName="Tom" lastName="Jerry" middleName="TJ" dob="1/1/2023" dept="mice" status="202" dept="house"

In above event, field dept is repeated (with value mice and house). I would like to find all the field names which are duplicated in single event / within the event

Tried dudep and other ways per google suggestion. But not able to get result.

Can you please help me with this. Thanks in advance.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| extract mv_add=t
| foreach *
    [| eval dups=if(mvcount(<<FIELD>>) > 1, if(isnull(dups),"<<FIELD>>",mvappend(dups,"<<FIELD>>")), dups)]
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...