I want to delete duplicate events means want only one event and other same event should be deleted.
also there is a newer script by zpavic:
see his answer to my question : link:remove duplicates on specific dates
also there is a newer script by zpavic:
see his answer to my question : link:remove duplicates on specific dates
Hi kml_uvce
the answer from gooza is a good one, he links to an app which you download and install into your splunk. afterwards you can run the script remove_duplicate_event.py
which will '| delete' the duplicates.
This will not really delete but make the result unsearchable so you will get single results rather then duplicates, read more here
cheers
Well the script is in that app gooza references. Download it and figure out stuff for yourself. We're here to help but you need to do some work on your own as well.
First thing I am not seeing any script remove_duplicate_event.py in splunk and second this will delete all events ? I want to keep one event