I have two log line with the same information. How can I do search so that it displays just one log??
For e.g.
2011-11-04 10:20:48,476 [WARN ] RemoteIpAddress: X.X.X.X; SessionId: XXX; exception: Password or Wolfram ID entered was incorrect
2011-11-04 10:20:48,476 [WARN ] RemoteIpAddress: X.X.X.X; SessionId: XXX; exception: Password or Wolfram ID entered was incorrect
I want it to display one result instead of two.
that's right but for splunk using uniq worked..thanks
I believe you want to investigate using the dedup command against a common field (possibly _raw). You should really fix the situation where it is logging multiple lines of the same content.