Splunk Search

Show only unique results

msarro
Builder

Hey everyone. One of my sources has a field which repeats occasionally. I want to filter out any events where there is a repeat of the particular field - so basically only return unique values. Really all I'm trying to get is a count of the non-repeated fields. I've tried using stats to subtract the distinct count from the normal count, but that still includes the repeated items. Any ideas would really be appreciated. Thanks!

To clarify, suppose your data set has a field called MYFIELD. Across 16 events, it has the following values:
1
1
1
1
1
2
3
4
5
5
6
7
8
9
9
9

Count would return 16.
dcount would return 9.
What I want is something that will return 6, counting only the fields which have no repeats.

Tags (1)
0 Karma

Ayn
Legend

You could build transactions using MYFIELD to tie them together and then check which ones only contain one event and count those.

<yourbasesearch> | transaction MYFIELD | where eventcount=1 | stats count
0 Karma

vlapeintuit
Explorer
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...