...rue
I am aware that I can run this to remove duplicates at search time.
| inputlookup myAAAlookup.csv
| dedup ACCT,AUID,ADDR
| outputlookup myAAAlookup.csv append=true
However, I want t...
When searching in our list of usernames that have logged in, I dedup the usernames but the results are case sensitive.
For example I have user01 and User01 both showing in the search results.
H...
Assuming there are 2 columns - Date & count and there are duplicates date.
How to dedup on Date and pick the maximum count value ?
2020-02-27 1522
2020-02-27 1680
2020-02-28 1639
2020-0...
I am facing issues wherein the events with same timestamp are not showing in results, when I dedup based on time, but I want all those events, even after dedup. Even epoch will be same for those e...
Hi. I am creating a search and dashboard to display our last ten locked account events. This seems to work well as I have it configured. One of the things I am doing is using the dedup command to r...
I can do the following separately, and I get the results I want.
index="wineventlog" EventIdentifier="4624" | dedup ComputerName
index="wineventlog" EventIdentifier="4688" AND (N...
Hello All, May I request you to help me with the query below I have two fields "customertripid & success" Customertripid has a unique id for a transaction - the transacti...