I have a requirement to find the duplicate events which are logged in Splunk with multiple sourcetypes.
For each log we have a unique id : 8b18881a-c6fe-4561-91f3-61c31b1afef5. I am able to get the logs with this unique id (multiple logs with different sourcetypes)
Is there any way to find the sourcetypes which are having the unique id, like as below.
unique id sourcetype1 sourcetype2 sourcetype2
8b18881a-c6fe-4561-91f3-61c31b1afef5 st_dev st1_dev1
21edc48b-0d90-43f2-bc1f-3dc6e322c821 st_dev st1_dev1 st3_dev3
Try this
<your search>
| stats values(sourcetype) as sourcetypes by unique_id
Try this
<your search>
| stats values(sourcetype) as sourcetypes by unique_id