Example One
To view events from unique devices:
... | dedup deviceAddress
Removes duplicate events from search results. That is, events that contain the same value in the specified field. The first matching event is kept, and the subsequent events with the same value in the specified field are removed.
Synopsis
... | dedup [N] <field1>,<field2>, ... [keepevents=(true|false)] [keepempty=(true|false)]
N is an optional number that specifies the number of duplicate events to keep. For example, “dedup 5 deviceEventClassId” will keep the first five events containing the same deviceEventClassId values for each deviceEventClassId, and remove the events that match after the first five have been kept. Default: 1.
field1, field2 is a field or a comma-separated field list whose values are compared to determine duplicate events. If a field list is specified, the values of the unique sets of all those fields are used to remove events. For example, if name and deviceCustomNumber1 are specified, and two events contain “Network Usage - Outbound” and “2347896”, only the first event is kept in the search results.
keepevents specifies whether to set the fields specified in the field list to NULL or not. When this option is set to True, the values are set to NULL and events are not removed from search results. However, when this option is set to False, duplicate events are removed from the search results. Default: False.
keepempty specifies whether to keep events in the search results whose specified fields contain NULL values. When this option is set to True, events with NULL values are kept, however if this option is set to False, events with NULL values are removed. Default: False.
Example One
To view events from unique devices:
... | dedup deviceAddress
Example Two
To view unique deviceEventClassId events from unique devices:
... | dedup deviceEventClassId deviceAddress
Example Three
To view the className in events with Java exceptions in the message field:
exception | <rex_expression> | dedup 5 className
In the example above, <rex_expression> is not shown in detail; however this expression extracts the class name in a field called className, which the dedup operator acts upon.