Splunk Search

Retrieve discarded values from the dedup command or other commands?

amorales_splunk
Splunk Employee
Splunk Employee

I want to use the dedup command and see which values it removes from a field. Is this possible?

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I suppose you can calculate which ones are removed by dedup, just not by using dedup.

| eventstats last(curious) as remaining by deduping
| stats values(curious) as all by deduping remaining
| eval removed = mvmap(all, if(all == remaining, null(), all))

Here, curious is the field you want to examine, and deduping is the field on which to dedup.

Tags (1)

richgalloway
SplunkTrust
SplunkTrust

Use the keepevents option to retain the duplicate events, but without the repeated field value.  Look for where the field is set to null.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...