Getting Data In

Delete a record conditional

riku4809
New Member

How can I delete the older UPDATE_TIME record(record2).

UNIQUE_ID, UPDATE_TIME・・・・・・
record1: 10001,2012/12/01,・・・・・・・・
record2: 10001,2012/11/01,・・・・・・・・

... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME)
⇒ I can get the record2
... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME) | delete
Error

Tags (2)
0 Karma

Ayn
Legend

You cannot run delete on transformed results, like what you get when you run stats. The delete command needs the raw events as input, otherwise it won't work. So, find a way to grab the events that you want to delete and pipe those events to delete.

riku4809
New Member

Ayn!
Thanks for your answer!
I want to determine the older data by Splunk.Use any Splunk's function to compare.

If there was something better solution, please let me know.

Thank you very much!

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...