Splunk Search

How to search two Indexes, but only use the dedup command for fields in one index?

boingodevin
Engager

I would like to search two different SourceTypes where one SourceType pipes a dedup command on fields that only that index hasaccess to and while the other index contains all its events. Is this possible? If so how would it be performed?

Example:

index="myIndex" source="source1" [search index="index2" source="source2" | dedup state]  my_field_1="1*" | ....more_commands_followed...
Tags (4)
0 Karma

lguinn2
Legend

Are you sure that you want "dedup"? dedup does not remove fields, it removes events that have duplicate values for the named fields. In your example, you are using a subsearch - I am pretty sure that you don't want to do that - a subsearch returns events that become selection criteria for the outer search; the events from the subsearch are not part of the results.

Please tell us what you are trying to do, as I think there may be a better way overall. Or maybe I am just confused and don't understand the question. But here is an answer to your question, sort of. To combine inputs from multiple sources, and dedup based on fields that appear in only one of the sources:

index="myIndex" source="source1"  my_field_1="1*"
| append [ search  index="index2" source="source2" | dedup state ]

If you want the criteria my_field_1="1*" to apply to both searches, do this

index="myIndex" source="source1"  my_field_1="1*"
| append [ search  index="index2" source="source2" my_field_1="1*" | dedup state ]
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...