Hello, I am having problems trying to find duplicate entries within my splunk kvstore. Basically, what I want to do is find duplicates based on a few fields such as FQDN, CVE, and PORT. Then, once I found duplicates I just want to output them in a table if their SOURCE field is different. The query I have so far is: | inputlookup vul_kvstore
| stats count by fqdn, port, cve
| where count>1
| table fqdn, port, cve, source The problem I have now is in my table I do not have access to the source field as it looks like the stats count line basically pulls out only the fqdn, port, and cve data. How do I get access to the source field data? Maybe I just have to revise my original query so I do not loose data to that field but so far nothing I try works. Hopefully someone can provide me some advise to push me through this problem. Thanks, Joe
... View more