Splunk Search

How to remove events that have the same field value in the result?

SplunkTrend
New Member

Basically, what I do is extracting the first 3 characters of the host field and show it in a separate field called Place. Now what I want to show is just records having different values in the same event and not show those records that have same value. Any help is appreciated. Thank you.

| stats list(host) AS host, list(Place) AS place by ip

IP               host          place
10.10.20.30      dalerf01      dal
                 dalerf02      dal

30.60.40.50      houl548       hou
                 grfd548       grf
0 Karma

somesoni2
Revered Legend

Try something like this

your base search which gives host, Place, ip | dedup ip Place  | stats list(host) AS host, list(Place) AS place by ip
0 Karma

renjith_nair
Legend

Try

| stats values(host) AS host, values(Place) AS place by ip

OR

Try dedup command

your search |dedup IP host place
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...