Splunk Search

Retrieve discarded values from the dedup command or other commands?

amorales_splunk
Splunk Employee
Splunk Employee

I want to use the dedup command and see which values it removes from a field. Is this possible?

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I suppose you can calculate which ones are removed by dedup, just not by using dedup.

| eventstats last(curious) as remaining by deduping
| stats values(curious) as all by deduping remaining
| eval removed = mvmap(all, if(all == remaining, null(), all))

Here, curious is the field you want to examine, and deduping is the field on which to dedup.

Tags (1)

richgalloway
SplunkTrust
SplunkTrust

Use the keepevents option to retain the duplicate events, but without the repeated field value.  Look for where the field is set to null.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...