https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584529#M203563 <P>but <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; my result has multiple hosts.. Not single host. Output should be&nbsp;<BR /><BR />1. abc 35.16 C:<BR />2.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="lia-unicode-emoji" title=":anguished_face:">😧</span><BR />3.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;E:<BR />4. def 45.56 C:<BR />5.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;I:<BR />6.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; J and etc</P> Thu, 10 Feb 2022 13:39:50 GMT priya1926 2022-02-10T13:39:50Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584515#M203554 <P>My Query is&nbsp;<BR /><BR /></P> <P>&nbsp;</P> <LI-CODE lang="markup">index=windows Type=Disk host IN (abc) FileSystem="*" DriveType="*" Name="*" | dedup host, Name | table _time, host, Name | sort host, Name | join type=left host [| search index=perfmon source="Perfmon:CPU" object=Processor collection=CPU counter="% Processor Time" instance=_Total host IN (abc) | convert num(Value) as value num(pctCPU) as value | stats avg(value) as "CPUTrend" max(value) as cpu_utz by host | eval "Max Peak CPU" = round(cpu_utz, 2) | eval "CPUTrend"=round(CPUTrend, 2) | fields - cpu_utz | sort -"Peak CPU" | rename "Max Peak CPU" AS "maxCPUutil" | dedup "maxCPUutil" | table _time, host, "maxCPUutil"] | table host, "maxCPUutil", Name</LI-CODE> <P>&nbsp;</P> <P><BR /><BR />I have this below output</P> <P>host maxCPUutil Name</P> <P>host&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;maxCPUutil&nbsp; &nbsp; &nbsp; &nbsp;Name<BR />abc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5.59&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;c:<BR />abc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5.59&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;E:<BR />abc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;5.59&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;F:</P> <P>&nbsp;</P> <P>What i want is</P> <P>host&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;maxCPUutil&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Name<BR />abc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5.59&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;C:<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;E:<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;F:</P> Thu, 10 Feb 2022 16:43:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584515#M203554 priya1926 2022-02-10T16:43:54Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584522#M203559 <LI-CODE lang="markup">| stats values(Name) as Name by host maxCPUutil</LI-CODE> Thu, 10 Feb 2022 12:44:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584522#M203559 ITWhisperer 2022-02-10T12:44:36Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584529#M203563 <P>but <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; my result has multiple hosts.. Not single host. Output should be&nbsp;<BR /><BR />1. abc 35.16 C:<BR />2.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="lia-unicode-emoji" title=":anguished_face:">😧</span><BR />3.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;E:<BR />4. def 45.56 C:<BR />5.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;I:<BR />6.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; J and etc</P> Thu, 10 Feb 2022 13:39:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584529#M203563 priya1926 2022-02-10T13:39:50Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584535#M203565 <P>I am not sure I understand the issue - the host is mentioned in the by clause so you should get a line for each host&nbsp;maxCPUutil combination with the Names listed in a multivalue field.</P> Thu, 10 Feb 2022 14:25:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584535#M203565 ITWhisperer 2022-02-10T14:25:27Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584720#M203686 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;any alternate method?</P> Fri, 11 Feb 2022 13:22:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584720#M203686 priya1926 2022-02-11T13:22:00Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584722#M203687 <P>What happened when you added the line I suggested already?</P> Fri, 11 Feb 2022 13:32:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584722#M203687 ITWhisperer 2022-02-11T13:32:55Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584742#M203695 <P>its like all the drive letters are coming in&nbsp; a single cell, single row.. they need to come in different rows.</P> Fri, 11 Feb 2022 14:42:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584742#M203695 priya1926 2022-02-11T14:42:15Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584746#M203697 <LI-CODE lang="markup">| mvexpand Name</LI-CODE> Fri, 11 Feb 2022 14:54:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584746#M203697 ITWhisperer 2022-02-11T14:54:01Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584757#M203700 <P>same like earlier</P> Fri, 11 Feb 2022 15:39:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584757#M203700 priya1926 2022-02-11T15:39:24Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584760#M203702 <P>Yes, you will either get a row for each Name with the data repeated when the host and maxCPUtil don't change; or a row for each host and maxCPUtil with a multivalue field of Names</P> Fri, 11 Feb 2022 15:46:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584760#M203702 ITWhisperer 2022-02-11T15:46:47Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584793#M203707 <P>You could do that but what for? What's the point of having results regarding the same entity with no connection to one another? If you, for example, resort the results you can't say which host the "empty" rows are for.</P> Fri, 11 Feb 2022 18:28:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-duplicate-values-in-a-column-of-table/m-p/584793#M203707 PickleRick 2022-02-11T18:28:48Z