topic Re: How to limit number of instance to 1 in Dashboards & Visualizations

How to limit number of instance to 1

aditsss — Thu, 31 Aug 2023 16:01:04 GMT

Hi Team,

I have below row logs:

2023-08-30 07:43:28.671 [INFO ] [Thread-18] ReadFileImpl - ebnc event balanced successfully

My current query:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| table EBNCMessage True

This occurs as many time as file got processed

I want to show only 1 event

ebnc event balanced successfully true

But its coming 8 times as 8 files go

Re: How to limit number of instance to 1

richgalloway — Thu, 31 Aug 2023 17:34:06 GMT

There are few ways to limit the number of results. The head, dedup, and stats commands can be used. Which to use depends on the inputs and the desired results.

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | head 1 | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCMessage="ebnc event balanced successfully" | table EBNCMessage True

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCMessage="ebnc event balanced successfully" | dedup EBNCMessage | table EBNCMessage True

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCMessage="ebnc event balanced successfully" | stats values(*) as * by EBNCMessage | table EBNCMessage True

Re: How to limit number of instance to 1

gcusello — Thu, 31 Aug 2023 21:31:31 GMT

Hi @aditsss ,

dedup your results:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCMessage="ebnc event balanced successfully" | dedup EBNCMessage | table EBNCMessage True

Ciao.

Giuseppe

Re: How to limit number of instance to 1

gcusello — Thu, 14 Sep 2023 09:08:55 GMT

Hi @aditsss,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉