Splunk Search

Retrieve discarded values from the dedup command or other commands?

Splunk Employee
Splunk Employee

I want to use the dedup command and see which values it removes from a field. Is this possible?

Labels (1)
Tags (1)
0 Karma


I suppose you can calculate which ones are removed by dedup, just not by using dedup.

| eventstats last(curious) as remaining by deduping
| stats values(curious) as all by deduping remaining
| eval removed = mvmap(all, if(all == remaining, null(), all))

Here, curious is the field you want to examine, and deduping is the field on which to dedup.

Tags (1)


Use the keepevents option to retain the duplicate events, but without the repeated field value.  Look for where the field is set to null.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...