Delete a record conditional

[riku4809]

How can I delete the older UPDATE_TIME record(record2).

UNIQUE_ID, UPDATE_TIME・・・・・・
record1: 10001,2012/12/01,・・・・・・・・
record2: 10001,2012/11/01,・・・・・・・・

... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME)
⇒ I can get the record2
... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME) | delete
⇒ Error

[Ayn]

You cannot run delete on transformed results, like what you get when you run stats. The delete command needs the raw events as input, otherwise it won't work. So, find a way to grab the events that you want to delete and pipe those events to delete.

[riku4809]

Ayn!
Thanks for your answer!
I want to determine the older data by Splunk.Use any Splunk's function to compare.

If there was something better solution, please let me know.

Thank you very much!