https://community.splunk.com/t5/Getting-Data-In/xpath-is-returning-the-duplicate-values-How-do-I-limit-the/m-p/261927#M50289 <P>Can you provide a single sample event? Anonymize as needed. It's going to be difficult to help without seeing what your event structure looks like.</P> Tue, 02 Feb 2016 03:52:56 GMT s2_splunk 2016-02-02T03:52:56Z https://community.splunk.com/t5/Getting-Data-In/xpath-is-returning-the-duplicate-values-How-do-I-limit-the/m-p/261926#M50288 <P>Hi All, </P> <P>Because of existing logs type, XPATH is returning a same value thrice. Is there any way to limit the number of values?<BR /> I am using max_match but seems like it is not working. Screenshot given below.</P> <P>Regards<BR /> Rishi</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1026i82A4F75F072CE0C9/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 02 Feb 2016 02:38:42 GMT https://community.splunk.com/t5/Getting-Data-In/xpath-is-returning-the-duplicate-values-How-do-I-limit-the/m-p/261926#M50288 rishiaggarwal 2016-02-02T02:38:42Z https://community.splunk.com/t5/Getting-Data-In/xpath-is-returning-the-duplicate-values-How-do-I-limit-the/m-p/261927#M50289 <P>Can you provide a single sample event? Anonymize as needed. It's going to be difficult to help without seeing what your event structure looks like.</P> Tue, 02 Feb 2016 03:52:56 GMT https://community.splunk.com/t5/Getting-Data-In/xpath-is-returning-the-duplicate-values-How-do-I-limit-the/m-p/261927#M50289 s2_splunk 2016-02-02T03:52:56Z https://community.splunk.com/t5/Getting-Data-In/xpath-is-returning-the-duplicate-values-How-do-I-limit-the/m-p/261928#M50290 <P>Hello rishiaggarwal,<BR /> I tried to solve your problem..........I have taken sample data returning the same results like you</P> <P>Data in my sample data </P> <P><STRONG>index="demo1"| table Username,ID,Date</STRONG><BR /> <IMG src="https://community.splunk.com/storage/temp/91174-demo3.jpg" alt="alt text" /></P> <P>Now i have written a query ..........for u r expected results </P> <P><STRONG>index="demo1"|streamstats count by _raw | search count&lt;2 | eval eid=_cd |transaction ID,Date maxspan=5s| table Username,ID,Date</STRONG><BR /> <IMG src="https://community.splunk.com/storage/temp/91175-demo4.jpg" alt="alt text" /></P> <P>I hope u can use this query on your data ..........let me know if it works for u ...........</P> Tue, 29 Sep 2020 08:37:50 GMT https://community.splunk.com/t5/Getting-Data-In/xpath-is-returning-the-duplicate-values-How-do-I-limit-the/m-p/261928#M50290 rakeshh123 2020-09-29T08:37:50Z