Splunk Search

SPL to retrieve more fields

indut
Path Finder

Hi all,

I am using splunk after a while and lost touch with the SPL. Please help me on below.

I have about 40 fields to extract using a SPL query. I am able to get all the fields required using interesting fields.

The issue that I am facing is that I am getting duplicate records in my result set (possibly it is due to the multiple source types that I am using in my query).  Just wondering what is the correct way to write SPL so that all fields that I retrieve are unique records. Don't think writing dedup on all 40 fields is a good idea. Also not sure if I use stats function,  do I have to write values(empno) as empno, vaues(empstartdate) as startdate.........on all 40 fields ? (If my data set has all employee details as an example)

 

Thanks in advance!

Labels (1)
Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Do all 40 fields appear in every event? If yes, then use the suggested dedup command below.

If all 40 fields do not appear in every event, do you have a primary key (field or fields that uniquely identify your event)? If yes, then your can do something like this.

your base search | fields ...list all 40 fields...
| stats values(*) as * by primary_key_fields

In all other cases it would be very difficult to get unique records, without multiple stats/streamstats.

View solution in original post

somesoni2
Revered Legend

Do all 40 fields appear in every event? If yes, then use the suggested dedup command below.

If all 40 fields do not appear in every event, do you have a primary key (field or fields that uniquely identify your event)? If yes, then your can do something like this.

your base search | fields ...list all 40 fields...
| stats values(*) as * by primary_key_fields

In all other cases it would be very difficult to get unique records, without multiple stats/streamstats.

ITWhisperer
SplunkTrust
SplunkTrust

You could try just dedup _raw

Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...