Getting Data In

xpath is returning the duplicate values. How do I limit the output to single values?

rishiaggarwal
Explorer

Hi All,

Because of existing logs type, XPATH is returning a same value thrice. Is there any way to limit the number of values?
I am using max_match but seems like it is not working. Screenshot given below.

Regards
Rishi

alt text

0 Karma
1 Solution

rakeshh123
Path Finder

Hello rishiaggarwal,
I tried to solve your problem..........I have taken sample data returning the same results like you

Data in my sample data

index="demo1"| table Username,ID,Date
alt text

Now i have written a query ..........for u r expected results

index="demo1"|streamstats count by _raw | search count<2 | eval eid=_cd |transaction ID,Date maxspan=5s| table Username,ID,Date
alt text

I hope u can use this query on your data ..........let me know if it works for u ...........

View solution in original post

0 Karma

rakeshh123
Path Finder

Hello rishiaggarwal,
I tried to solve your problem..........I have taken sample data returning the same results like you

Data in my sample data

index="demo1"| table Username,ID,Date
alt text

Now i have written a query ..........for u r expected results

index="demo1"|streamstats count by _raw | search count<2 | eval eid=_cd |transaction ID,Date maxspan=5s| table Username,ID,Date
alt text

I hope u can use this query on your data ..........let me know if it works for u ...........

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Can you provide a single sample event? Anonymize as needed. It's going to be difficult to help without seeing what your event structure looks like.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...