https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-specific-rows-in-a-table-based-on-column/m-p/262659#M78859 <P>Hello, </P> <P>I have a table like the one below, with a column containing repeated id numbers form one side and respective messages for each id on the other side. I want to make a search which can show the id numbers that have only "Error" message as value and skip repeating ids that have Error and OK. Any help is much appreciated. </P> <PRE><CODE>col1 col2 11111 Error 11111 OK 55555 Error </CODE></PRE> <P>In the example, successful query should return 55555.</P> Mon, 05 Dec 2016 10:16:53 GMT parizanov 2016-12-05T10:16:53Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-specific-rows-in-a-table-based-on-column/m-p/262659#M78859 <P>Hello, </P> <P>I have a table like the one below, with a column containing repeated id numbers form one side and respective messages for each id on the other side. I want to make a search which can show the id numbers that have only "Error" message as value and skip repeating ids that have Error and OK. Any help is much appreciated. </P> <PRE><CODE>col1 col2 11111 Error 11111 OK 55555 Error </CODE></PRE> <P>In the example, successful query should return 55555.</P> Mon, 05 Dec 2016 10:16:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-specific-rows-in-a-table-based-on-column/m-p/262659#M78859 parizanov 2016-12-05T10:16:53Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-specific-rows-in-a-table-based-on-column/m-p/262660#M78860 <P>Try this</P> <PRE><CODE>base search | chart count over col1 by col2 | where col2=0 </CODE></PRE> <P>*<STRONG><EM>OR</EM></STRONG>*</P> <PRE><CODE>base search | eventstats values(col2) as status by col1 | where isnull(mvfind(status, "OK")) </CODE></PRE> Mon, 05 Dec 2016 14:28:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-specific-rows-in-a-table-based-on-column/m-p/262660#M78860 sundareshr 2016-12-05T14:28:22Z