Hi guys,
I was wondering if someone could point me in the right direction with an issue I've been having.
Basically I have a search thats set to pull usernames from a KV lookup, the issue is theres "duplicate" entries in the lookup e.g.
Username and Username@email
Is there any way to stop the duplicate users from appearing in the search results? I seem to be at a bit of a dead end.
Thanks
Those are not duplicates. If you want to filter out similar results then you need to modify your search to normalize the data. For example:
... | eval username = replace(username, "@.*", "")
Those are not duplicates. If you want to filter out similar results then you need to modify your search to normalize the data. For example:
... | eval username = replace(username, "@.*", "")
Just what I needed Rich, thanks very much! 🙂