https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548701#M155665 <P>Try <FONT face="courier new,courier">mvexpand</FONT>.</P><LI-CODE lang="markup">index=purchase_store_x1 | rex mode=sed "s/^(?i)(?:(?!{).)+//g" | spath | search BodyJson.name="pdone.ok" | rename BodyJson.product.ID as PRODUCT | rename BodyJson.ID.CX.Unique as ID | mvexpand PRODUCT | table ID PRODUCT | sort -ID</LI-CODE><P>&nbsp;</P> Wed, 21 Apr 2021 00:29:59 GMT richgalloway 2021-04-21T00:29:59Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548694#M155664 <P>Hello Everyone I hope you are safe and sound,</P><P>I'm extracting values from events that come in a Json format and after that I want to create a Table were I can see each ID and the product thy bought from the store but I am always getting within a single cell the same value repeated two times and when I try to do a stats count then... it is also count twice...</P><LI-CODE lang="markup">This is my code: index=purchase_store_x1 | rex mode=sed "s/^(?i)(?:(?!{).)+//g" | spath | search BodyJson.name="pdone.ok" | rename BodyJson.product.ID as PRODUCT | rename BodyJson.ID.CX.Unique as ID | table ID PRODUCT | sort -ID</LI-CODE><P>and so instead of getting the ID asociaed with the product purchased I get something like this:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%" height="22px">ID</TD><TD width="50%" height="22px">PRODUCT</TD></TR><TR><TD width="50%" height="43px">31254<BR />31254</TD><TD width="50%" height="43px">XUI45<BR />XUI45</TD></TR><TR><TD width="50%" height="43px">54581<BR />54581</TD><TD width="50%" height="43px">XUI8<BR />XUI45</TD></TR><TR><TD width="50%" height="43px">47851<BR />47851</TD><TD width="50%" height="43px">XUIE58<BR />XUI45</TD></TR></TBODY></TABLE><P><BR />How can I just a normal table without having the same value repeated twice in the cell? THANK YOU SO MUCH for your help,</P> Tue, 20 Apr 2021 23:06:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548694#M155664 andres91302 2021-04-20T23:06:49Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548701#M155665 <P>Try <FONT face="courier new,courier">mvexpand</FONT>.</P><LI-CODE lang="markup">index=purchase_store_x1 | rex mode=sed "s/^(?i)(?:(?!{).)+//g" | spath | search BodyJson.name="pdone.ok" | rename BodyJson.product.ID as PRODUCT | rename BodyJson.ID.CX.Unique as ID | mvexpand PRODUCT | table ID PRODUCT | sort -ID</LI-CODE><P>&nbsp;</P> Wed, 21 Apr 2021 00:29:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548701#M155665 richgalloway 2021-04-21T00:29:59Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548702#M155666 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232004">@andres91302</a>&nbsp;</P><P>It looks like ID is always duplicated, but product can be different, so if that's the case</P><LI-CODE lang="markup">..your_search.. | eval ID=mvdedup(ID), PRODUCT=mvdedup(PRODUCT) | table ID PRODUCT | sort -ID</LI-CODE><P>or</P><LI-CODE lang="markup">..your_search.. | eval ID=mvdedup(ID) | stats values(PRODUCT) by ID | sort -ID</LI-CODE><P>use whichever suits your data better</P><P>&nbsp;</P> Wed, 21 Apr 2021 00:49:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548702#M155666 bowesmana 2021-04-21T00:49:24Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548706#M155667 <P>Thank you so much for your help this was excellent</P> Wed, 21 Apr 2021 02:44:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548706#M155667 andres91302 2021-04-21T02:44:57Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548707#M155668 <P>Thank you so much! 10/10</P> Wed, 21 Apr 2021 02:45:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-values-from-appearing-twice-in-a-single-cell-of-a/m-p/548707#M155668 andres91302 2021-04-21T02:45:32Z