xpath is returning the duplicate values. How do I limit the output to single values?

[rishiaggarwal]

Hi All,

Because of existing logs type, XPATH is returning a same value thrice. Is there any way to limit the number of values?
I am using max_match but seems like it is not working. Screenshot given below.

Regards
Rishi

[rakeshh123 · Accepted solution]

Hello rishiaggarwal,
I tried to solve your problem..........I have taken sample data returning the same results like you

Data in my sample data

index="demo1"| table Username,ID,Date

Now i have written a query ..........for u r expected results

index="demo1"|streamstats count by _raw | search count<2 | eval eid=_cd |transaction ID,Date maxspan=5s| table Username,ID,Date

I hope u can use this query on your data ..........let me know if it works for u ...........

[s2_splunk]

Can you provide a single sample event? Anonymize as needed. It's going to be difficult to help without seeing what your event structure looks like.