Splunk Search

How to removine duplicates in a single field?

smanojkumar
Contributor

Hi There!

    Good day,

    I need to remove repeated entries of same values in single field, I'm unable to separate into single values by using values() , mvsplit commands,

Actual one - 

src_name serial

item-s1028501 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn

 

Expected one -

src_name serial

item-s1028501 5cd022g2wn 

 

I just mentioned only one values in src_name, we are having multiple values in src_name to work with,

Thanks in Advance !

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Not sure why the split wasn't recognising the \n - try replacing them with commas, and splitting by those

| eval unique=mvdedup(split(replace(trim(serial_number),"\n",","),","))

View solution in original post

0 Karma

TrangCIC81
Communicator

Is the name of the field containing duplicates that you want to remove "src_name"?
if so you can use the below

<your_search> | dedup src_name
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval unique=mvdedup(split(serial," "))
0 Karma

smanojkumar
Contributor

Hi @ITWhisperer ,

   After applying the comamand, I got this,

The data is from lookup,

 

serial src_name length unique

5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn item-s10285012718
5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The example you posted has the values separated by spaces (which is what my solution deals with). If your serial field is not actually like that, which would cause the solution to not give the expected answer, you will have to explain what you actual field contains. For example, is it already a multivalue field, or are the values separated by tabs or commas. If you don't provide an accurate representation of your data, you cannot expect an accurate solution to be provided.

0 Karma

smanojkumar
Contributor

Here is the actual data in JSON format,

 

{"preview":false,"lastrow":true,"result":{"serial":"5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn  ","src_name":"item-s1028501","length":"2718"}}
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Since you appear to have a trailing space as well as have \n delimiters, try this

| eval unique=mvdedup(split(trim(serial),"\n"))
0 Karma

smanojkumar
Contributor

Hi @ITWhisperer ,

   I got the same output as previous,

smanojkumar_0-1684144625315.png



Thanks in Advance!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure why the split wasn't recognising the \n - try replacing them with commas, and splitting by those

| eval unique=mvdedup(split(replace(trim(serial_number),"\n",","),","))
0 Karma

smanojkumar
Contributor

Thanks @ITWhisperer , It worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...