Splunk Search

deduping one field by another field

ajdyer2000
Path Finder

Hi

I'm very new to Splunk so hopefully this is an easy one.

I have 2 Fields server_name and userid. I would like to remove duplicates from the "userid" field while keeping the values of "server_name"

for example

Search results

server1, user1
server1, user2
server1, user2
server1, user3
server1, user4
server2, user1
server2, user1
server2, user1
server2 user2
server2, user3
server2, user4
server2, user4

What I would like the results to be:

server1, user1
server1, user2
server1, user3
server1, user4
server2, user1
server2 user2
server2, user3
server2, user4

Thanks

Tags (1)
0 Karma

acharlieh
Influencer

Looking at your results, actually you should know that dedup can take multiple fields in which case you wind up with all unique sets of fields:

base search | dedup server_name, userid

To try this out you could mock up your example data, with a base search like:

| noop | stats count | eval raw = split("server1,user1;server1,user2;server1,user2;server1,user3;server1,user4;server2,user1;server2,user1;server2,user1;server2,user2;server2,user3;server2,user4;server2,user4",";") | mvexpand raw | eval server=mvindex(split(raw,","),0) | eval user=mvindex(split(raw,","),1) | fields server,user

Then compare the result to:

| noop | stats count | eval raw = split("server1,user1;server1,user2;server1,user2;server1,user3;server1,user4;server2,user1;server2,user1;server2,user1;server2,user2;server2,user3;server2,user4;server2,user4",";") | mvexpand raw | eval server=mvindex(split(raw,","),0) | eval user=mvindex(split(raw,","),1) | fields server,user | dedup server_name, userid

MuS
Legend

Hi ajdyer2000,

you can try stats and the values() option:

your base search here | stats count values(server_name) AS server_name BY userid | fields - count

Hope this helps to get you started ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...