topic Re: Delete a record conditional in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Delete-a-record-conditional/m-p/51577#M9899 <P>Ayn!<BR /> Thanks for your answer!<BR /> I want to determine the older data by Splunk.Use any Splunk's function to compare.</P> <P>If there was something better solution, please let me know.</P> <P>Thank you very much!</P> Tue, 04 Dec 2012 01:48:09 GMT riku4809 2012-12-04T01:48:09Z Delete a record conditional https://community.splunk.com/t5/Getting-Data-In/Delete-a-record-conditional/m-p/51575#M9897 <P>How can I delete the older UPDATE_TIME record(record2).</P> <P>UNIQUE_ID, UPDATE_TIME・・・・・・<BR /> record1: 10001,2012/12/01,・・・・・・・・<BR /> <EM>record2: 10001,2012/11/01,・・・・・・・・</EM></P> <P>... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME)<BR /> ⇒ I can get the record2<BR /> ... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME) | delete<BR /> ⇒ <STRONG>Error</STRONG></P> Mon, 28 Sep 2020 12:54:05 GMT https://community.splunk.com/t5/Getting-Data-In/Delete-a-record-conditional/m-p/51575#M9897 riku4809 2020-09-28T12:54:05Z Re: Delete a record conditional https://community.splunk.com/t5/Getting-Data-In/Delete-a-record-conditional/m-p/51576#M9898 <P>You cannot run <CODE>delete</CODE> on transformed results, like what you get when you run <CODE>stats</CODE>. The <CODE>delete</CODE> command needs the raw events as input, otherwise it won't work. So, find a way to grab the events that you want to delete and pipe those events to <CODE>delete</CODE>.</P> Mon, 03 Dec 2012 09:14:58 GMT https://community.splunk.com/t5/Getting-Data-In/Delete-a-record-conditional/m-p/51576#M9898 Ayn 2012-12-03T09:14:58Z Re: Delete a record conditional https://community.splunk.com/t5/Getting-Data-In/Delete-a-record-conditional/m-p/51577#M9899 <P>Ayn!<BR /> Thanks for your answer!<BR /> I want to determine the older data by Splunk.Use any Splunk's function to compare.</P> <P>If there was something better solution, please let me know.</P> <P>Thank you very much!</P> Tue, 04 Dec 2012 01:48:09 GMT https://community.splunk.com/t5/Getting-Data-In/Delete-a-record-conditional/m-p/51577#M9899 riku4809 2012-12-04T01:48:09Z