Knowledge Management

Delete overlaps from summary index

rroberts
Splunk Employee
Splunk Employee

The knowledge manager manual mentions ""Manually delete the overlaps from the summary index using the search language." I'm familiar with the Delete command and how it works. But, what other command(s) would you use to pipe only the dups to the Delete command, whilst preserving only one copy of each events?

index=summary search_name=xyz et= lt= **Twilight Zone********* | delete**

In other words, how do I output only duplicates, but exclude one copy (or the original)?

Tags (2)

gkanapathy
Splunk Employee
Splunk Employee

You would use the overlap search command, but I'm not sure you can pipe the output of that to delete, which is what I think "manually" is trying to get across.

rroberts
Splunk Employee
Splunk Employee

yes, I used ...index=summary search_name=productPurchased | overlap but I could not pipe to delete (This command cannot be invoked after the non-streaming command 'overlap'.) Pipe to overlap did generate a results table with overlap_latest and overlap_earliest fields but not sure how to use these.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...