Getting Data In

xpath is returning the duplicate values. How do I limit the output to single values?

rishiaggarwal
Explorer

Hi All,

Because of existing logs type, XPATH is returning a same value thrice. Is there any way to limit the number of values?
I am using max_match but seems like it is not working. Screenshot given below.

Regards
Rishi

alt text

0 Karma
1 Solution

rakeshh123
Path Finder

Hello rishiaggarwal,
I tried to solve your problem..........I have taken sample data returning the same results like you

Data in my sample data

index="demo1"| table Username,ID,Date
alt text

Now i have written a query ..........for u r expected results

index="demo1"|streamstats count by _raw | search count<2 | eval eid=_cd |transaction ID,Date maxspan=5s| table Username,ID,Date
alt text

I hope u can use this query on your data ..........let me know if it works for u ...........

View solution in original post

0 Karma

rakeshh123
Path Finder

Hello rishiaggarwal,
I tried to solve your problem..........I have taken sample data returning the same results like you

Data in my sample data

index="demo1"| table Username,ID,Date
alt text

Now i have written a query ..........for u r expected results

index="demo1"|streamstats count by _raw | search count<2 | eval eid=_cd |transaction ID,Date maxspan=5s| table Username,ID,Date
alt text

I hope u can use this query on your data ..........let me know if it works for u ...........

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Can you provide a single sample event? Anonymize as needed. It's going to be difficult to help without seeing what your event structure looks like.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...