Hello I am forwarding remote Linux machines' logs to central splunk; and doing the simple GUI search as below: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw | dedup host The results are below: which is CORRECT ++++++++++++++++++++++++++++++++++++++++ host _raw 1 1.1.1.1 Jan 3 15:36:09 1.1.1.1 sudo(pam_unix)[550]: session closed for user root 2 2.2.2.2 Jan 3 15:30:15 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/uptime Whereas I am running the same command in CLI as below: /var/splunk/bin/splunk search 'source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw |dedup host'>1.txt Now the output of 1.txt is as below: which is NOT CORRECT or SAME as GUI ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw Jan 3 15:54:19 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/upti me Jan 3 15:54:15 1.1.1.1 sudo(pam_unix)[7725]: session closed for user root Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw Jan 3 15:54:19 2.2.2.2 sudo: root : sorry, you must have a tty to run sudo ; TTY=unknown ; PWD=/root ; USER=root ; COMMAND=/usr/bin/upti me Jan 3 15:54:15 1.1.1.1 sudo(pam_unix)[7725]: session closed for user root ============================== Questions 1. Why the result is appearing two times 2. also why "Preview of: source="/var/log/remotelogs" "sudo" earliest=-4hr |table host _raw" appearing and that too TWO times? Can you help Platform details Open Suse Linux 12.2 / RSYSLOG / Splunk version 5.0.1, build 143156 ... View more