How can I delete the older UPDATE_TIME record(record2).
UNIQUE_ID, UPDATE_TIME・・・・・・
record1: 10001,2012/12/01,・・・・・・・・
record2: 10001,2012/11/01,・・・・・・・・
... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME)
⇒ I can get the record2
... | stats count, values(UPDATE_TIME) AS DATE by UNIQUE_ID | stats min(UPDATE_TIME) | delete
⇒ Error
You cannot run delete
on transformed results, like what you get when you run stats
. The delete
command needs the raw events as input, otherwise it won't work. So, find a way to grab the events that you want to delete and pipe those events to delete
.
Ayn!
Thanks for your answer!
I want to determine the older data by Splunk.Use any Splunk's function to compare.
If there was something better solution, please let me know.
Thank you very much!