Splunk Search
Highlighted

Which value does the dedup command keep?

Splunk Employee
Splunk Employee

I am running the dedup command for my ip_address field and I want to know the value returned by the command. Is it the last value seen, first value seen, something random? My search looks like this;

sourcetype=firewall_log | dedup ip_address
Tags (2)
Highlighted

Re: Which value does the dedup command keep?

Splunk Employee
Splunk Employee

The dedup command will return the first key value found for that particular field. This means the most recent in time, as splunk searches from latest to earliest. For example, in the search that dedups the ip_address value for your firewall log, you will see the most recent ip_address that has been logged to that source.

For more detail: http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup

View solution in original post