Dashboards & Visualizations

select rows having similar values in table

vikas_baranwal
Path Finder

Hello Splunkers,

I need your help to create SPL for below where I am facing issue.

In table, any status is having more than than one entry with different timings before moving to another status. It is not with every Status. I want to collect record for only one row for any Status (with min Updated column value).

e.g. status "Ready For Dev" is moved to "In Dev" then "In QA" then "In Dev" then "In QA' then again "Ready For Dev" Status and finally "In Dev" status. In this I want to collect for all the movements.

Thanks for your help in advance!

alt text

Tags (1)
0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

(your search)
|dedup key,Status consecutive=true

View solution in original post

0 Karma

HiroshiSatoh
Champion

Try this!

(your search)
|dedup key,Status consecutive=true
0 Karma

vikas_baranwal
Path Finder

Hi @HiroshiSatoh ,

I am thankful to you as you helped me a lot by providing me exact solution. I feel honored that I am part of such a great a community with high level of knowledge people and all helping hands here.

Thanks once again!

0 Karma

deepashri_123
Motivator

Hey@vikas_baranwal,

Are you trying to have each status once instead of repeating multiple times?
Can you try using dedup Status?

Let me know if this helps!!

0 Karma

vikas_baranwal
Path Finder

Hi @deepashri ,

Thanks for your reply and help. I was using dedup already but I was missing a command which was advised by @HiroshiSatoh and that worked really well.

Thanks once again!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...