Archive

select rows having similar values in table

Path Finder

Hello Splunkers,

I need your help to create SPL for below where I am facing issue.

In table, any status is having more than than one entry with different timings before moving to another status. It is not with every Status. I want to collect record for only one row for any Status (with min Updated column value).

e.g. status "Ready For Dev" is moved to "In Dev" then "In QA" then "In Dev" then "In QA' then again "Ready For Dev" Status and finally "In Dev" status. In this I want to collect for all the movements.

Thanks for your help in advance!

alt text

Tags (1)
0 Karma
1 Solution

Champion

Try this!

(your search)
|dedup key,Status consecutive=true

View solution in original post

0 Karma

Champion

Try this!

(your search)
|dedup key,Status consecutive=true

View solution in original post

0 Karma

Path Finder

Hi @HiroshiSatoh ,

I am thankful to you as you helped me a lot by providing me exact solution. I feel honored that I am part of such a great a community with high level of knowledge people and all helping hands here.

Thanks once again!

0 Karma

Motivator

Hey@vikas_baranwal,

Are you trying to have each status once instead of repeating multiple times?
Can you try using dedup Status?

Let me know if this helps!!

0 Karma

Path Finder

Hi @deepashri ,

Thanks for your reply and help. I was using dedup already but I was missing a command which was advised by @HiroshiSatoh and that worked really well.

Thanks once again!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!