https://community.splunk.com/t5/Getting-Data-In/Help-with-filtering-results/m-p/32219#M5717 <P>I figured it out:</P> <P>dedup dest_ip,dest_port sortby -score</P> Wed, 26 Jan 2011 04:41:20 GMT jambajuice 2011-01-26T04:41:20Z https://community.splunk.com/t5/Getting-Data-In/Help-with-filtering-results/m-p/32218#M5716 <P>I have results that look like the following</P> <P>dest_ip, dest_port, protocol, cve_id, score </P> <P>192.168.1.1, 80, tcp, 2009-1234, 8.5<BR /> 192.168.1.1, 80, tcp, 2007-6543, 9<BR /> 192.168.1.1, 80, tcp, 2004-8435, 6 </P> <P>If I want to return the result for each dest_ip/dest_port combination that has the highest score, how do I do that? I've tried using sort and dedup to sort the fields by score (descending) and then dedup the results, but it isn't working.</P> <P>Any help would be appreciated.</P> <P>Thx.</P> <P>Craig</P> Wed, 26 Jan 2011 04:11:31 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-filtering-results/m-p/32218#M5716 jambajuice 2011-01-26T04:11:31Z https://community.splunk.com/t5/Getting-Data-In/Help-with-filtering-results/m-p/32219#M5717 <P>I figured it out:</P> <P>dedup dest_ip,dest_port sortby -score</P> Wed, 26 Jan 2011 04:41:20 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-filtering-results/m-p/32219#M5717 jambajuice 2011-01-26T04:41:20Z