dedup command syntax details

Syntax details

The required syntax is in bold.

dedup

[<int>]

[keepempty=<bool>]

[consecutive=<bool>]

<field-list>

Required arguments

<field-list>

Syntax: <field> ["," <field>] ...

Description: A list of comma-separated field names to remove duplicate values from. You must specify at least one field.

Optional arguments

consecutive

Syntax: consecutive=<boolean>

Description: If set to true, removes only events with duplicate combinations of values that are consecutive.

Default: false

<int>

Syntax: <int>

Description: The dedup command retains multiple events for each combination when you specify <int>. The number for <int> must be greater than 0. If you do not specify a number, only the first occurring event is kept. All other duplicates are removed from the results.

Default: 1

keepempty

Syntax: keepempty=<boolean>

Description: If set to true, keeps every event where one or more of the specified fields is not present (null).

Default: false. All events where any of the selected fields are null are dropped.

The keepempty=true argument keeps every event that does not have one or more of the fields in the <field-list>.

See also

dedup command

dedup command overview

dedup command usage

dedup command examples