Splunk Search

Delete duplicate events

kml_uvce
Builder

I want to delete duplicate events means want only one event and other same event should be deleted.

Tags (1)
1 Solution

gooza
Communicator

also there is a newer script by zpavic:

see his answer to my question : link:remove duplicates on specific dates

View solution in original post

gooza
Communicator

also there is a newer script by zpavic:

see his answer to my question : link:remove duplicates on specific dates

MuS
SplunkTrust
SplunkTrust

Hi kml_uvce

the answer from gooza is a good one, he links to an app which you download and install into your splunk. afterwards you can run the script remove_duplicate_event.py which will '| delete' the duplicates.

This will not really delete but make the result unsearchable so you will get single results rather then duplicates, read more here

cheers

0 Karma

Ayn
Legend

Well the script is in that app gooza references. Download it and figure out stuff for yourself. We're here to help but you need to do some work on your own as well.

0 Karma

kml_uvce
Builder

First thing I am not seeing any script remove_duplicate_event.py in splunk and second this will delete all events ? I want to keep one event

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...