topic Re: How to remove the row if the column is same? in Splunk Search

How to remove the row if the column is same?

Wind — Wed, 31 Dec 2014 09:15:32 GMT

Such as when I using the following search:
sourcetype="xyz" status=* |stats dc(ID) by ID status |sort by ID
I will get the following table
ID status dc(ID)
12345 true 1
12345 false 1
92345 true 1
82345 false 1

Can you tell me how to get the following table?
ID status dc(ID)
12345 true 1
92345 true 1
82345 false 1

That means remove the above second row(When ID is duplicated, remove the row about the "false" column)

Thanks advance for your help.

Re: How to remove the row if the column is same?

Wind — Wed, 31 Dec 2014 09:35:17 GMT

I have fixed by myself as followings:)
sourcetype="xyz" status=* |stats dc(ID) by ID status |sort ID| sort - status | dedup 1 ID

Re: How to remove the row if the column is same?

neelamssantosh — Tue, 06 Jan 2015 15:50:34 GMT

dedup is a expensive command.
so, instead use only ID after by clause section i.e,

sourcetype="xyz" status=* |stats values(status) dc(ID) by ID |sort by ID