Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF



Removes the events that contain an identical combination of values for the fields that you specify.

With the dedup command, you can specify the number of duplicate events to keep for each value of a single field, or for each combination of values among several fields. Events returned by dedup are based on search order. For historical searches, the most recent events are searched first. For real-time searches, the first events that are received are searched, which are not necessarily the most recent events.

You can specify the number of events with duplicate values, or value combinations, to keep. You can sort the fields, which determines which event is retained. Other options enable you to retain events with the duplicate fields removed, or to keep events where the fields specified do not exist in the events.


dedup [<int>] <field-list> [keepevents=<bool>] [keepempty=<bool>] [consecutive=<bool>] [sortby <sort-by-clause>]

Required arguments

Syntax: <string> <string> ...
Description: A list of field names to remove duplicate values from.

Optional arguments

Syntax: consecutive=<bool>
Description: If true, only remove events with duplicate combinations of values that are consecutive.
Default: false
Syntax: keepempty=<bool>
Description: If set to true, keeps every event where one or more of the specified fields is not present (null).
Default: false. All events where any of the selected fields are null are dropped.
The keepempty=true argument keeps every event that does not have one or more of the fields in the field list. To keep N representative events for combinations of field values including null values, use the fillnull command to provide a non-null value for these fields. For example:

...| fillnull value="MISSING" field1 field2 | dedup field1 field2

Syntax: keepevents=<bool>
Description: If true, keep all events, but will remove the selected fields from events after the first event containing a particular combination of values.
Default: false. Events are dropped after the first event of each particular combination.
Syntax: <int>
Description: The dedup command retains multiple events for each combination when you specify N. The number for N must be greater than 0. If you do not specify a number, only the first occurring event is kept. All other duplicates are removed from the results.
Syntax: sortby ( - | + ) <sort-field> [(- | +) <sort_field> ...]
Description: List of the fields to sort by and the sort order. Use the dash symbol ( - ) for descending order and the plus symbol ( + ) for ascending order. You must specify the sort order for each field specified in the <sort-by-clause>. The <sort-by-clause> determines which of the duplicate events to keep. When the list of events is sorted, the top-most event in the sorted list is retained.

Sort field options

Syntax: <field> | auto(<field>) | str(<field>) | ip(<field>) | num(<field>)
Description: The options that you can specify to sort the events.
Syntax: <string>
Description: The name of the field to sort.
Syntax: auto(<field>)
Description: Determine automatically how to sort the field values.
Syntax: ip(<field>)
Description: Interpret the field values as IP addresses.
Syntax: num(<field>)
Description: Interpret the field values as numbers.
Syntax: str(<field>)
Description: Order the field values by using the lexicographic order.


The dedup command is a streaming command or a dataset processing command, depending on which arguments are specified with the command. See Command types.

Avoid using the dedup command on the _raw field if you are searching over a large volume of data. If you search the _raw field, the text of every event in memory is retained which impacts your search performance. This is expected behavior. This behavior applies to any field with high cardinality and large size.

Multivalue fields

To use the dedup command on multivalue fields, the fields must match all values to be deduplicated.

Lexicographical order

Lexicographical order sorts items based on the values used to encode the items in computer memory. In Splunk software, this is almost always UTF-8 encoding, which is a superset of ASCII.

  • Numbers are sorted before letters. Numbers are sorted based on the first digit. For example, the numbers 10, 9, 70, 100 are sorted lexicographically as 10, 100, 70, 9.
  • Uppercase letters are sorted before lowercase letters.
  • Symbols are not standard. Some symbols are sorted before numeric values. Other symbols are sorted before or after letters.


Example 1:

Remove duplicates of results with the same 'host' value.

... | dedup host

Example 2:

Remove duplicates of results with the same 'source' value and sort the events by the '_time' field in ascending order.

... | dedup source sortby +_time

Example 3:

Remove duplicates of results with the same 'source' value and sort the events by the '_size' field in descending order.

... | dedup source sortby -_size

Example 4:

For events that have the same 'source' value, keep the first 3 that occur and remove all subsequent events.

... | dedup 3 source

Example 5:

For events that have the same 'source' AND 'host' values, keep the first 3 that occur and remove all subsequent events.

... | dedup 3 source host

See also



Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the dedup command.


This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.10, 6.4.11, 6.5.0, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 8.0.0, 8.0.1, 8.0.2, 6.4.9, 6.5.1, 6.5.10, 6.5.1612 (Splunk Cloud only)


The answer regarding dedup on mv fields is this: The multivalue field must match all values to be deduped. ```| stats count | eval field=mvappend("a","b") | append [| stats count | eval field=mvappend("1","2")] | append [| stats count | eval field=mvappend("a1","b2")] | append [| stats count | eval field=mvappend("a1","b2")] | append [| stats count | eval field=mvappend("a1","a2")] | dedup field```
Similarly, coalesce brings the multivalue straight across when the respective multivalue field is chosen.

October 8, 2019


The only part of the dedup command that makes it not streaming is the '[sortby <sort-by-clause>]' argument. If you dont' specify that argument, the command is streaming, but not distributable streaming. Hope this clarifies it for you !

Lstewart splunk, Splunker
May 3, 2019

Which arguments make this a streaming command?

April 30, 2019

I carried out a simple test and discovered that to dedup and keep the LATEST event, you want to "| dedup field1 sortby -_time"

Bedgar oneok
December 26, 2014

We need an answer to Landen99's question. Does "| dedup field1 sortby +_time" keep the earliest matching event or the latest matching event?

Bedgar oneok
December 26, 2014

Question on the "sortby" option. Does "sortby" sort the results of the dedup or sort for the dedup? In other words:<br /><br /> | dedup field1 sortby +_time<br /><br />1) the first event for each value is chosen and then these events are sorted by time OR<br />2) the earliest event is chosen for each value?

November 26, 2014

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters