topic Re: Consolidating table entries in Splunk Search

Consolidating table entries

dwear — Thu, 21 Jul 2016 15:16:58 GMT

192.168.1.7 |table Realm, Role

I have a search and I'm trying to consolidate to unique combinations of Realm and Role.

 Realm         Role
 Realm A      Role A
 Realm A      Role A
 Realm A      Role A
 Realm A      Role B
 Realm A      Role A
 Realm B      Role B
 Realm B      Role C

As you can see above, there is duplicates. I tried "|dedup Realm" but I feel like its eliminating some unique combinations by eliminating duplicate Realms. I'd like see if look like this.

 Realm         Role
 Realm A      Role A
 Realm A      Role B
 Realm B      Role B
 Realm B      Role C

Re: Consolidating table entries

javiergn — Thu, 21 Jul 2016 15:28:34 GMT

Faster and nicer than dedup:

| stats count by Realm, Role
| fields - count

Re: Consolidating table entries

woodcock — Thu, 21 Jul 2016 15:28:56 GMT

Use 2 fields, like this:

192.168.1.7 | dedup Realm Role | table Realm Role

Re: Consolidating table entries

Stevelim — Thu, 21 Jul 2016 21:58:03 GMT

| stats values(Realm)  as Realm, values(Role)  as Role