Splunk Search

Removing duplicates

12onetwo
New Member

HI , i am new to splunk i need to create a report that has rest calls which has mulitple path parameters , so it was showing the multiple uris to make a status count on that
for example:
/t1/email/ksjdf@gmail.com
/t1/email/ksjdf@gmail.com/f1/12345
/t1/email/ytft@gmail.com
/t1/email/ytft@gmail.com/f1/123456

result should be like this :
/t1/email/
/t1/email/XXXX/f1/XXXX

how to remove the duplicates herer , i am not which command to use?..

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi 12onetwo,

given you have a field called path or uri you can use dedup on this field

base search goes here | dedup uri | stats count by uri

see the doce for more details http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Dedup

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...