Splunk Search

How to remove unique rows from a table? Is there a command opposite to dedup?

MayankSplunk
Path Finder

From my search and transaction command I get the following table. To further process my results, I want to remove the row with ID V3 because it does not exist for type B. Is there a command opposite to dedup?

Type      ID    Score
A         V1     123
B         V1     786
A         V2     45
B         V2     34
A         V3     95
1 Solution

MayankSplunk
Path Finder

Ok found a way to do it

stats count dc(Type) as sourcetypes by ID | search sourcetypes > 1

change sourcetypes > 0 to 1 to remove unique row

View solution in original post

MayankSplunk
Path Finder

Ok found a way to do it

stats count dc(Type) as sourcetypes by ID | search sourcetypes > 1

change sourcetypes > 0 to 1 to remove unique row

MayankSplunk
Path Finder

I have updated the answer.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Wouldn't this keep all the rows?

somesoni2
Revered Legend

This can be achieved in two steps. (may need adjustment per your search)

your search producing above | eventstats count by ID | where count > 1

This will remove all the records where ID appears only once (unique).

MayankSplunk
Path Finder

Thanks @somesoni2 - that works as well.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

How to Monitor AI Agents with Splunk Agent Observability

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...