Splunk Search

Retrieve discarded values from the dedup command or other commands?

Splunk Employee
Splunk Employee

I want to use the dedup command and see which values it removes from a field. Is this possible?

Labels (1)
Tags (1)
0 Karma


I suppose you can calculate which ones are removed by dedup, just not by using dedup.

| eventstats last(curious) as remaining by deduping
| stats values(curious) as all by deduping remaining
| eval removed = mvmap(all, if(all == remaining, null(), all))

Here, curious is the field you want to examine, and deduping is the field on which to dedup.

Tags (1)


Use the keepevents option to retain the duplicate events, but without the repeated field value.  Look for where the field is set to null.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...