Splunk Search

How to removine duplicates in a single field?

smanojkumar
Communicator

Hi There!

    Good day,

    I need to remove repeated entries of same values in single field, I'm unable to separate into single values by using values() , mvsplit commands,

Actual one - 

src_name serial

item-s1028501 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn

 

Expected one -

src_name serial

item-s1028501 5cd022g2wn 

 

I just mentioned only one values in src_name, we are having multiple values in src_name to work with,

Thanks in Advance !

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Not sure why the split wasn't recognising the \n - try replacing them with commas, and splitting by those

| eval unique=mvdedup(split(replace(trim(serial_number),"\n",","),","))

View solution in original post

0 Karma

TrangCIC81
Communicator

Is the name of the field containing duplicates that you want to remove "src_name"?
if so you can use the below

<your_search> | dedup src_name
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval unique=mvdedup(split(serial," "))
0 Karma

smanojkumar
Communicator

Hi @ITWhisperer ,

   After applying the comamand, I got this,

The data is from lookup,

 

serial src_name length unique

5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn item-s10285012718
5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The example you posted has the values separated by spaces (which is what my solution deals with). If your serial field is not actually like that, which would cause the solution to not give the expected answer, you will have to explain what you actual field contains. For example, is it already a multivalue field, or are the values separated by tabs or commas. If you don't provide an accurate representation of your data, you cannot expect an accurate solution to be provided.

0 Karma

smanojkumar
Communicator

Here is the actual data in JSON format,

 

{"preview":false,"lastrow":true,"result":{"serial":"5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn  ","src_name":"item-s1028501","length":"2718"}}
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Since you appear to have a trailing space as well as have \n delimiters, try this

| eval unique=mvdedup(split(trim(serial),"\n"))
0 Karma

smanojkumar
Communicator

Hi @ITWhisperer ,

   I got the same output as previous,

smanojkumar_0-1684144625315.png



Thanks in Advance!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure why the split wasn't recognising the \n - try replacing them with commas, and splitting by those

| eval unique=mvdedup(split(replace(trim(serial_number),"\n",","),","))
0 Karma

smanojkumar
Communicator

Thanks @ITWhisperer , It worked.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...