topic How to get unique data? in Splunk Enterprise

How to get unique data?

Keerthi — Wed, 17 May 2023 11:31:09 GMT

Hi All,

I have a query and the results shows as above. The column function as only single value. I need to get only one value instead of two as the_time also remains same. Can anyone help me to get single value instead of the value repeating twice.

Re: How to get unique data

ITWhisperer — Wed, 17 May 2023 06:36:34 GMT

Your SPL is correct for what you are trying to achieve - what may not be "correct" is your data. Does the function have trailing white spaces for example, which makes them look the same but in fact they are different?

You could try trimming the field before the dedup

Re: How to get unique data

Keerthi — Wed, 17 May 2023 08:01:08 GMT

Hi Sir,

I tried but still am getting two values.

Re: How to get unique data

ITWhisperer — Wed, 17 May 2023 08:21:32 GMT

Field names are case-sensitive - try using Function instead of function.

(My excuse is that I was unable to accurately copy your image into a text box - in future, it is usually best to use the code block </> option to include SPL or event text so that formatting and typos are reduced.)

Re: How to get unique data

Keerthi — Thu, 18 May 2023 11:02:04 GMT

I tried keeping the case sensitive topic in my mind but it still fetches 2 rows.
i tried using:

|stats first(Function) command to get the first row. But the query when applied to filter does not produce the result.

any help here pls

Re: How to get unique data

ITWhisperer — Thu, 18 May 2023 11:07:42 GMT

If you just want the first event, use this

| head 1

Re: How to get unique data

Keerthi — Thu, 18 May 2023 12:00:57 GMT

Thnaks that worked, but i lately realised one thing that the names ( i mean the spelling) is wrong. is there nay chance to hardcode the value manually in splunk.

HELP PLS!!

Re: How to get unique data

ITWhisperer — Thu, 18 May 2023 12:21:41 GMT

You could hardcode replacements of incorrect spellings with correct spellings replace function