Splunk Search

Why splunk Search returning duplicates?

karthi25
Path Finder

As shown below I have only two events present on my index

splunk_norm.png

But when i execute the below search query


index = **** |rex field=_raw "(?msi)(?<json_field>\{.+\}$)" | spath input=json_field |rename SCMSplunkLog.SCMFailureLog.appName as APPNAME,SCMSplunkLog.SCMFailureLog.eventType as EVENTTYPE,SCMSplunkLog.SCMFailureLog.payload.level as LEVEL,SCMSplunkLog.SCMFailureLog.payload.errorDescription as ERRORDESCRIPTION,SCMSplunkLog.SCMFailureLog.payload.startTime as STARTDATE,SCMSplunkLog.SCMFailureLog.payload.endTime as ENDDATE |where APPNAME!="" and LEVEL="ERROR"|table APPNAME,EVENTTYPE,STARTDATE,ENDDATE,LEVEL,ERRORDESCRIPTION

I was getting duplicate entries on result table as below
splunk_general_search.PNG

Can anyone please help me with this.

Edited:
Attached sample json:

{
  "SCMSplunkLog" : {
    "SCMFailureLog" : {
      "appName" : "Testing_splunk_alerts_log",
      "eventType" : "Testing_splunk_alerts_log",
      "payload" : {
        "level" : "ERROR",
        "startTime" : "2022-04-12T13:57:49.156Z",
        "successCount" : 0,
        "failureCount" : 0,
        "publishedCount" : 0,
        "errorCode" : 0,
        "errorDescription" : "ERROR: relation \"test.testLand\" does not exist\n  Position: 8",
        "sourceCount" : 0,
        "endTime" : "2022-04-12T13:57:54.483Z"
      }
    }
  }
}

 

Labels (4)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

I tried the same that you have. It seems working as expected.

| makeresults | eval _raw="{
  \"SCMSplunkLog\" : {
    \"SCMFailureLog\" : {
      \"appName\" : \"Testing_splunk_alerts_log\",
      \"eventType\" : \"Testing_splunk_alerts_log\",
      \"payload\" : {
        \"level\" : \"ERROR\",
        \"startTime\" : \"2022-04-12T13:57:49.156Z\",
        \"successCount\" : 0,
        \"failureCount\" : 0,
        \"publishedCount\" : 0,
        \"errorCode\" : 0,
        \"errorDescription\" : \"ERROR: relation \"test.testLand\" does not exist\n  Position: 8\",
        \"sourceCount\" : 0,
        \"endTime\" : \"2022-04-12T13:57:54.483Z\"
      }
    }
  }
}"

VatsalJagani_0-1649829821656.png

 

0 Karma

karthi25
Path Finder

@mayurr98  updated my post with  sample JSON

0 Karma

mayurr98
Super Champion

Could you please give us sample JSON raw events. paste in </> 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...