topic Re: Filter Multiple Event Results Into A Single Value in Splunk Search

Filter Multiple Event Results Into A Single Value

dunsha — Mon, 29 May 2017 19:04:19 GMT

I would like to return the value of a string only once even if it shows up multiple times in splunk. For example:

"rscprod" "rscapirequestresponse" "caseId"// : //"2209102486"

The search above returns multiple 200+ events, I would like my search to research count = 1 for <"caseId"// : //"2209102486">

adonio — Mon, 29 May 2017 20:01:59 GMT

hope i understand you correctly,
try: your search for string here | head 1

lukas_loder — Mon, 29 May 2017 20:54:59 GMT

Or do you want to count for each caseId?
so you get a list like:
caseId1 count=2
caseId2 count=1
caseId3 count=5

| stats count by caseId

kmorris_splunk — Tue, 30 May 2017 01:12:40 GMT

You could use dedup on the caseId field, provided it is being extracted:

[YOUR BASE SEARCH]
| dedup caseId