Archive

How do you exclude results based on multiple fields?

HealyManTech
Explorer

I am trying to get where I have if the _time and host are the same I exclude those results. I was thinking an eval or where statement might do it, but I can't figure out the syntax for either one.

I tried stats to count(_time) and where count is >=2 to show the results to test but it gives me no results.

Any thoughts would help.

0 Karma

saurabhkharkar
Path Finder

if you are trying to delete duplicates
eg:
2018-12-27 13:14:08 host
2018-12-27 13:14:08 host
you can use - | dedup _time host (you will have just 1 event left)

if you are trying to completely exclude the events, try using
| stats dc(host) as count by _time | where count =1

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!