Getting Data In

Delete a record conditional

riku4809
New Member

How can I delete the older UPDATE_TIME record(record2).

UNIQUE_ID, UPDATE_TIME・・・・・・
record1: 10001,2012/12/01,・・・・・・・・
record2: 10001,2012/11/01,・・・・・・・・

... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME)
⇒ I can get the record2
... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME) | delete
Error

Tags (2)
0 Karma

Ayn
Legend

You cannot run delete on transformed results, like what you get when you run stats. The delete command needs the raw events as input, otherwise it won't work. So, find a way to grab the events that you want to delete and pipe those events to delete.

riku4809
New Member

Ayn!
Thanks for your answer!
I want to determine the older data by Splunk.Use any Splunk's function to compare.

If there was something better solution, please let me know.

Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...