Getting Data In

Delete a record conditional

riku4809
New Member

How can I delete the older UPDATE_TIME record(record2).

UNIQUE_ID, UPDATE_TIME・・・・・・
record1: 10001,2012/12/01,・・・・・・・・
record2: 10001,2012/11/01,・・・・・・・・

... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME)
⇒ I can get the record2
... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME) | delete
Error

Tags (2)
0 Karma

Ayn
Legend

You cannot run delete on transformed results, like what you get when you run stats. The delete command needs the raw events as input, otherwise it won't work. So, find a way to grab the events that you want to delete and pipe those events to delete.

riku4809
New Member

Ayn!
Thanks for your answer!
I want to determine the older data by Splunk.Use any Splunk's function to compare.

If there was something better solution, please let me know.

Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...