How to limit number of instance to 1

[aditsss]

Hi Team,

I have below row logs:

2023-08-30 07:43:28.671 [INFO ] [Thread-18] ReadFileImpl - ebnc event balanced successfully

My current query:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| table EBNCMessage True

This occurs as many time as file got processed

I want to show only 1 event

ebnc event balanced successfully                         true

But its coming 8 times as 8 files go

[gcusello · Accepted solution]

Hi @aditsss ,

dedup your results:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| dedup EBNCMessage 
| table EBNCMessage True

Ciao.

Giuseppe

[gcusello]

Hi @aditsss,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[richgalloway]

There are few ways to limit the number of results.  The head, dedup, and stats commands can be used.  Which to use depends on the inputs and the desired results.

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| head 1
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| table EBNCMessage True

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| dedup EBNCMessage
| table EBNCMessage True

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCMessage="ebnc event balanced successfully"
| stats values(*) as * by EBNCMessage
| table EBNCMessage True