Dashboards & Visualizations

How to limit number of instance to 1

aditsss
Motivator

Hi Team,

I have below row logs:

2023-08-30 07:43:28.671 [INFO ] [Thread-18] ReadFileImpl - ebnc event balanced successfully

My current query:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| table EBNCMessage True

This occurs as many time as file got processed

I want to show only 1 event

ebnc event balanced successfully                         true

But its coming 8 times as 8 files go

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss ,

dedup your results:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| dedup EBNCMessage 
| table EBNCMessage True

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss ,

dedup your results:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| dedup EBNCMessage 
| table EBNCMessage True

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are few ways to limit the number of results.  The head, dedup, and stats commands can be used.  Which to use depends on the inputs and the desired results.

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| head 1
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| table EBNCMessage True
index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| dedup EBNCMessage
| table EBNCMessage True
index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| stats values(*) as * by EBNCMessage
| table EBNCMessage True

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...