Splunk® Cloud Services

SPL2 Search Reference

dedup command syntax details

Syntax details

The required syntax is in bold.

dedup
[<int>]
[keepempty=<bool>]
[consecutive=<bool>]
<field-list>

Required arguments

<field-list>
Syntax: <field> ["," <field>] ...
Description: A list of comma-separated field names to remove duplicate values from. You must specify at least one field.

Optional arguments

consecutive
Syntax: consecutive=<boolean>
Description: If set to true, removes only events with duplicate combinations of values that are consecutive.
Default: false
<int>
Syntax: <int>
Description: The dedup command retains multiple events for each combination when you specify <int>. The number for <int> must be greater than 0. If you do not specify a number, only the first occurring event is kept. All other duplicates are removed from the results.
Default: 1
keepempty
Syntax: keepempty=<boolean>
Description: If set to true, keeps every event where one or more of the specified fields is not present (null).
Default: false. All events where any of the selected fields are null are dropped.
The keepempty=true argument keeps every event that does not have one or more of the fields in the <field-list>.


See also

dedup command
dedup command overview
dedup command usage
dedup command examples
Last modified on 20 October, 2020
dedup command overview   dedup command usage

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters