topic Re: unique within each group in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589657#M205315 <P>Since I wanted to know the flow of data from one sourcetype to another sourcetype.&nbsp; Apparently, in my case, the data after existing a sourcetype can re enter the sourcetype at a later point of time.</P><P>Thank you</P> Fri, 18 Mar 2022 09:59:03 GMT msg4sunil 2022-03-18T09:59:03Z How do I get unique within each group? https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589648#M205308 <P>Team,</P> <P>Can you please help me with the splunk query for the below?</P> <P>Thank you</P> <P>Splunk query returns the below</P> <DIV> <PRE>1 1 1 2 2 2 3 1 1 3 1</PRE> <P>How do I&nbsp;get the below( unique within each group)?</P> <DIV> <PRE>1 2 3 1</PRE> <P>&nbsp;</P> </DIV> </DIV> Fri, 18 Mar 2022 15:04:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589648#M205308 msg4sunil 2022-03-18T15:04:00Z Re: unique within each group https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589650#M205309 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/244042">@msg4sunil</a>&nbsp;<BR /><BR /></P><P>use<BR /><BR />values(fieldname1) by&nbsp;fieldname2</P> Fri, 18 Mar 2022 09:49:54 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589650#M205309 SanjayReddy 2022-03-18T09:49:54Z Re: unique within each group https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589653#M205311 <P>How did you get this result?</P><P>Why is 1 still repeated in your required result?</P> Fri, 18 Mar 2022 09:52:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589653#M205311 ITWhisperer 2022-03-18T09:52:46Z Re: unique within each group https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589655#M205313 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/236694">@SanjayReddy</a>&nbsp;</P><P>Can you please clarify as how do I use&nbsp;</P><DIV class=""><DIV class=""><P>values(fieldname1) by&nbsp;fieldname2?</P></DIV></DIV><DIV class=""><DIV class=""><DIV class=""><DIV>&nbsp;</DIV></DIV><DIV class=""><DIV><DIV class=""><DIV class=""><DIV class="">My original query is&nbsp;</DIV><DIV class=""><SPAN>index=*|table sourcetype</SPAN></DIV><DIV class="">&nbsp;</DIV><DIV class=""><SPAN>Thank you</SPAN></DIV></DIV></DIV></DIV></DIV></DIV></DIV> Fri, 18 Mar 2022 09:56:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589655#M205313 msg4sunil 2022-03-18T09:56:06Z Re: unique within each group https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589656#M205314 <LI-CODE lang="markup">index=*|table sourcetype|dedup sourcetype</LI-CODE> Fri, 18 Mar 2022 09:58:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589656#M205314 ITWhisperer 2022-03-18T09:58:18Z Re: unique within each group https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589657#M205315 <P>Since I wanted to know the flow of data from one sourcetype to another sourcetype.&nbsp; Apparently, in my case, the data after existing a sourcetype can re enter the sourcetype at a later point of time.</P><P>Thank you</P> Fri, 18 Mar 2022 09:59:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589657#M205315 msg4sunil 2022-03-18T09:59:03Z Re: unique within each group https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589659#M205317 <P>Sorry, I cant be using dedup, since that doesn't solve my purpose.</P> Fri, 18 Mar 2022 10:00:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589659#M205317 msg4sunil 2022-03-18T10:00:33Z Re: unique within each group https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589663#M205319 <LI-CODE lang="markup">index=* | table sourcetype | streamstats current=f window=2 last(sourcetype) as previous_sourcetype | where sourcetype != previous_sourcetype</LI-CODE> Fri, 18 Mar 2022 10:19:22 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589663#M205319 ITWhisperer 2022-03-18T10:19:22Z Re: unique within each group https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589667#M205321 <P>Wow. Amazing. Thanks a lot!</P> Fri, 18 Mar 2022 10:30:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-unique-within-each-group/m-p/589667#M205321 msg4sunil 2022-03-18T10:30:46Z