Splunk Search

Search for Duplicate RecordNumbers

rmcdougal
Path Finder

Basically, I want to create a search that will alert me in a forwarder is indexing the same data multiple times. We currently have a few that are and I want to see how many others are doing the same thing. So what I want is a search that will return the hostname of PC's that are indexing events with the same RecordNumber on the same day. I can't figure out how to accomplish it.

0 Karma

ziegfried
Influencer

Assuming that the RecordNumber is an extracted field, you could use such a search to list all host having multiple occurrences of the same RecordNumber on a single day:

RecordNumber=* | eval day=strftime(_time,"%Y%m%d") | stats count by host,day,RecordNumber | where count>0
0 Karma

tiny3001
Path Finder

I know I'm resurrecting something old here... but shouldn't it be '| where count>1'

We currently running into this problem, and yes, the search above is definitely the best way of finding duplicates

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...