Removes the events that contain an identical combination of values for the fields that you specify.
dedup command, you can specify the number of duplicate events to keep for each value of a single field, or for each combination of values among several fields. Events returned by
dedup are based on search order. For historical searches, the most recent events are searched first. For real-time searches, the first events that are received are search, which are not necessarily the most recent events.
You can specify the number of events with duplicate values, or value combinations, to keep. You can sort the fields. When you sort, the
dedup command deduplicates the results based on the specified sort-by fields. Other options enable you to retain events with the duplicate fields removed, or to keep events where the fields specified do not exist in the events.
Note: We do not recommend that you run the
dedup command against the
_raw field if you are searching over a large volume of data. If you search the
_raw field the text of every event in memory is retained, which impacts your search performance. This is expected behavior. This behavior applies to any field with high cardinality and large size.
dedup [<int>] <field-list> [keepevents=<bool>] [keepempty=<bool>] [consecutive=<bool>] [sortby <sort-by-clause>]
- Syntax: <string> <string> ...
- Description: A list of field names.
- Syntax: consecutive=<bool>
- Description: If true, only remove events with duplicate combinations of values that are consecutive.
- Default: false
- Syntax: keepempty=<bool>
- Description: If set to true, keeps every events where one or more of the specified fields is not present (null).
- Default: false. All events where any of the selected fields are null are dropped.
keepempty=trueargument keeps every event that does not have one or more of the fields in the field list. To keep N representative events for combinations of field values including null values, use the fillnull command to provide a non-null value for these fields. For example:
...| fillnull value="MISSING" field1 field2 | dedup field1 field2
- Syntax: keepevents=<bool>
- Description: If true, keep all events, but will remove the selected fields from events after the first event containing a particular combination of values.
- Default: false. Events are dropped after the first event of each particular combination.
- Syntax: <int>
- Description: The
dedupcommand retains multiple events for each combination when you specify
N. The number for
Nmust be greater than 0. If you do not specify a number, only the first occurring event is kept. All other duplicates are removed from the results.
- Syntax: ( - | + ) <sort-field> [(- | +) <sort_field> ...]
- Description: List of the fields to sort by and the sort order. Use the dash symbol ( - ) for descending order and the plus symbol ( + ) for ascending order. You must specify the sort order for each field.
Descriptions for the sort_field options
- Syntax: <field> | auto(<field>) | str(<field>) | ip(<field>) | num(<field>)
- Description: The options that you can specify to sort the events.
- Syntax: <string>
- Description: The name of the field to sort.
- Syntax: auto(<field>)
- Description: Determine automatically how to sort the field values.
- Syntax: ip(<field>)
- Description: Interpret the field values as IP addresses.
- Syntax: num(<field>)
- Description: Interpret the field values as numbers.
- Syntax: str(<field>)
- Description: Order the field values by using the lexicographic order.
Remove duplicates of results with the same 'host' value.
... | dedup host
Remove duplicates of results with the same 'source' value and sort the events by the '_time' field in ascending order.
... | dedup source sortby +_time
Remove duplicates of results with the same 'source' value and sort the events by the '_size' field in descending order.
... | dedup source sortby -_size
For events that have the same 'source' value, keep the first 3 that occur and remove all subsequent events.
... | dedup 3 source
For events that have the same 'source' AND 'host' values, keep the first 3 that occur and remove all subsequent events.
... | dedup 3 source host
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the dedup command.
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2