Splunk Search
Highlighted

Question about table and duplicate fields

Communicator

Hello everyone,

I have a splunk request that creates a table with two fields X and Y and i want to deduplicate lines when there is this situatin :

           X - Y
entry 1 :  A   B
entry 2 :  B   A

how can i do that ? dedup x,y doesn't work 😞

thanks,

Damien

Tags (3)
0 Karma
Highlighted

Re: Question about table and duplicate fields

SplunkTrust
SplunkTrust

Those two lines don't look like duplicates to me, so dedup isn't going to throw one out. One would be thrown out if X=A and Y=B is true for both events.

0 Karma
Highlighted

Re: Question about table and duplicate fields

Legend

You could do something like this:

yoursearchhere
| eval compareString = min(X,Y) + max(X,Y)
| dedup compareString
| fields - compareString

I am not entirely sure this will work, but I think it will

View solution in original post

Highlighted

Re: Question about table and duplicate fields

Communicator

thanks a lot

0 Karma