Splunk Search

suppressing adjacent events with duplicate field values

Justin_Grant
Contributor

I have a log which often has redundant events, where "redundant" is defined as 2+ events, on subsequent lines, where each redundant event has the same value for a particular field (e.g. "ID").

How can I suppress the second and subsequent events so only the first event in a set shows up in my search results?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can pipe the events through | dedup consecutive=true fieldname

sourcetype=mydupeylog | dedup consecutive=true mydupeyfield

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You can pipe the events through | dedup consecutive=true fieldname

sourcetype=mydupeylog | dedup consecutive=true mydupeyfield

Justin_Grant
Contributor

Cool! BTW, the docs for the dedup command are here: http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...