Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to only display unique values from a field?

$
0
0
I am searching the my logs for key IDs that can either be from group 'AA' or group 'BB'. I find them by using rex and then display them in a table. (AA_12345 for example). "ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?(AA_\d+)|(BB_\d+))" | table id Some of those key IDs are duplicates. I only want to show unique key IDs in the table. How can I do this? Based on some posts I found on here there is something called 'dedup' that might be useful here but I can't figure out where I'd insert it in my search query. Any help is appreciated, thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>