Splunk Search

How to remove duplicate events if all data is identical except the time and duration fields?

Path Finder

Hey, Fellow Splunkers

I have multiple duplicated events, all data on the event is identical to the exception of the time. I'm attempting to filter based on Alert ID; however, both events have the same alert id, but different times and Duration: for example:

Oct 31 00:16:50 alert: 123 Duration 200
Oct 31 00:18:50 alert: 123 Duration 300

Does Splunk have a compare operator to SORT the differences between the time or Duration which will help me eliminate the duplicates? The only concept the Duration could be random.

Thank You,

0 Karma


They are not actually duplicates so you're going to want to do some research what your data is doing and why.

|dedup 1 day sortby day

You need to make sure that you specify which field you want your dedup to sort your data by.

0 Karma


An event "AlertId1,Duration1" if occurred at time T1 and at time T2, then for Splunk it is two different events as it happened at two different times. Keeping that in context a duplicate event will be when "AlertId1, Duration1, T1" occurs twice. This above scenario can be deduplicated by using dedup command as follows:

your base query to return fields alertId, duration
| dedup _time, alertId, duration
| complete your query

or if you want to deduplicate the data you are getting irrespective of the time it gets indexed at try

your base query to return events
| dedup _raw
| complete your query
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...