Getting Data In
Highlighted

xpath is returning the duplicate values. How do I limit the output to single values?

Explorer

Hi All,

Because of existing logs type, XPATH is returning a same value thrice. Is there any way to limit the number of values?
I am using max_match but seems like it is not working. Screenshot given below.

Regards
Rishi

alt text

0 Karma
Highlighted

Re: xpath is returning the duplicate values. How do I limit the output to single values?

Splunk Employee
Splunk Employee

Can you provide a single sample event? Anonymize as needed. It's going to be difficult to help without seeing what your event structure looks like.

0 Karma
Highlighted

Re: xpath is returning the duplicate values. How do I limit the output to single values?

Path Finder

Hello rishiaggarwal,
I tried to solve your problem..........I have taken sample data returning the same results like you

Data in my sample data

index="demo1"| table Username,ID,Date
alt text

Now i have written a query ..........for u r expected results

index="demo1"|streamstats count by raw | search count<2 | eval eid=cd |transaction ID,Date maxspan=5s| table Username,ID,Date
alt text

I hope u can use this query on your data ..........let me know if it works for u ...........

View solution in original post

0 Karma