Splunk Search

remove duplicate or similar event in a trasaction command from the search

amir_thales
Path Finder

Hello Everybody,

I want to remove similar event which are in a transaction command.

In my case, I want to merge the eventcode 4663 similar so that only 1 eventcode 4663

Be careful, there are event code 4663 that are not similar so there will be 2 event code 4663 in this case.

Here is my request which display the result below:

host="XXXX" "eventcode=4663" OR "eventcode=7036" | transaction startswith="*running state." endswith="*stopped state."

i try dedup but without success.

Thank you
Amir

alt text

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @amir_thales,

I'm uncleared about your requirement.

Meanwhile can you please try mvdedup?

host="XXXX" "eventcode=4663" OR "eventcode=7036" | transaction startswith="*running state." endswith="*stopped state." | eval eventcode=mvdedup(eventcode).

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/MultivalueEvalFunctions#mvde...

Thanks

0 Karma

amir_thales
Path Finder

Hello @kamlesh_vaghela and everybody,

The solution you proposed to me does not work.

I want to merge the same events which are between eventcode="7036", i want to merge all duplicates so that only one eventcode = "4663" remains.

But i want to do a difference between eventcode="4663" there are message where the eventcode is 4663 but the message is different and i want to merge duplicate and only display a message of each.

for example 1:

eventcode"7336"
eventcode"4663" -> message A
eventcode"4663" -> message A ---> here i want to merge eventcode"4663"so that there is only one left because these events are the same.
eventcode"4663" -> message A
eventcode"7336"

example 2:

eventcode"7336"
eventcode"4663" -> message A
eventcode"4663" -> message A ---> here i want to merge eventcode"4663"->message A so that there is only one left because these events are the same.
eventcode"4663" -> message B ---> here i want to remove one eventcode"4663"->message B so that there is only one left because these events are the same
eventcode"4663" -> message B
eventcode"7336"

thank you

Amir

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @amir_thales,
Can you please share sample events?

0 Karma

amir_thales
Path Finder

@kamlesh_vaghela,

i put a sample in my first post.

i have 3 eventcode"4663" and i want to merge them.

Maybe, i must do something before to do the "transaction" but i don't know any function which merge similar events.

thank you

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
Can you please try this ?

sourcetype="WinEventLog:Security"  "EventCode=4663" OR "EventCode=7036"
| rex field=_raw "EventCode=(?<EventRaw>.*)" max_match=0
| eval EventRaw=mvdedup(EventRaw) 
| table _time EventRaw
0 Karma

amir_thales
Path Finder

@kamlesh_vaghela,

This request display me a table which list all eventcode"4663".

So i want just merge the eventcode"4663" which are between the eventcode"7036".

I just read the different evencode'4663' and I noticed that the eventcodes "4663" were not identical because the application that executes is different.

So much for me and thank you for your help.

If you know a function or a way of answering the original question even if my problem is solved it would not be a refusal, so it will be useful for me in the future.

Thank you
Amir

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...