You guys are great - not to mention patient and not giving me crap for being deaf dumb and blind - I found the export option (right in front of me) and am pretty confident that the punct field gives me a significant head start on uniques and if not I can just do whole chunks at a time. Thanks very much for your help!! -Senor Nooblet ... View more

I got the delete thing wrong, I just misinterpreted (thanks tho!) The problem with dedup is that with syslog it doesnt recognize the "meat" of the entry as a field - it recognizes most of the syslog as separate fields but not the event detail for some reason. example: May 10 17:47:16 device12345 242504: May 10 17:47:15.795 EDT: %LINK-3-UPDOWN: Interface FastEthernet9/99, changed state to down So I want all hostname+"meat" uniques, right? The hostname in this example is "device12345" and the meat is "Interface FastEthernet9/99, changed state to down" however that section is not identified as a field by splunk - only all the timestamp, event type, etc, preceding it. If these were all loaded in sql or excel, I could do a RIGHT 100 or something just to get all distinct characters from the end of the entry but Splunk uses a proprietary database so I cant do t-sql or anything and want to know the equivalent. ... View more