Splunk Search

Why splunk Search returning duplicates?

karthi25
Path Finder

As shown below I have only two events present on my index

splunk_norm.png

But when i execute the below search query


index = **** |rex field=_raw "(?msi)(?<json_field>\{.+\}$)" | spath input=json_field |rename SCMSplunkLog.SCMFailureLog.appName as APPNAME,SCMSplunkLog.SCMFailureLog.eventType as EVENTTYPE,SCMSplunkLog.SCMFailureLog.payload.level as LEVEL,SCMSplunkLog.SCMFailureLog.payload.errorDescription as ERRORDESCRIPTION,SCMSplunkLog.SCMFailureLog.payload.startTime as STARTDATE,SCMSplunkLog.SCMFailureLog.payload.endTime as ENDDATE |where APPNAME!="" and LEVEL="ERROR"|table APPNAME,EVENTTYPE,STARTDATE,ENDDATE,LEVEL,ERRORDESCRIPTION

I was getting duplicate entries on result table as below
splunk_general_search.PNG

Can anyone please help me with this.

Edited:
Attached sample json:

{
  "SCMSplunkLog" : {
    "SCMFailureLog" : {
      "appName" : "Testing_splunk_alerts_log",
      "eventType" : "Testing_splunk_alerts_log",
      "payload" : {
        "level" : "ERROR",
        "startTime" : "2022-04-12T13:57:49.156Z",
        "successCount" : 0,
        "failureCount" : 0,
        "publishedCount" : 0,
        "errorCode" : 0,
        "errorDescription" : "ERROR: relation \"test.testLand\" does not exist\n  Position: 8",
        "sourceCount" : 0,
        "endTime" : "2022-04-12T13:57:54.483Z"
      }
    }
  }
}

 

Labels (4)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

I tried the same that you have. It seems working as expected.

| makeresults | eval _raw="{
  \"SCMSplunkLog\" : {
    \"SCMFailureLog\" : {
      \"appName\" : \"Testing_splunk_alerts_log\",
      \"eventType\" : \"Testing_splunk_alerts_log\",
      \"payload\" : {
        \"level\" : \"ERROR\",
        \"startTime\" : \"2022-04-12T13:57:49.156Z\",
        \"successCount\" : 0,
        \"failureCount\" : 0,
        \"publishedCount\" : 0,
        \"errorCode\" : 0,
        \"errorDescription\" : \"ERROR: relation \"test.testLand\" does not exist\n  Position: 8\",
        \"sourceCount\" : 0,
        \"endTime\" : \"2022-04-12T13:57:54.483Z\"
      }
    }
  }
}"

VatsalJagani_0-1649829821656.png

 

0 Karma

karthi25
Path Finder

@mayurr98  updated my post with  sample JSON

0 Karma

mayurr98
Super Champion

Could you please give us sample JSON raw events. paste in </> 

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...