Remove duplicate URLs from search result

[r_s01]

Trying to get success and failure status count using below query but its not filtering out the duplicate URLs, Can someone help me into this? I want result in less number of rows but lob, URI, API_Status  and its count should show.

"*/prescriptions/eni/api/api-cw/*" (URI != "*/prescriptions/eni/api/api-cw/legacySession/cache*") | stats count by lob,URI,API_Staus

Result is coming as below,

[isoutamo]

Can you give some sample data which helps us to understand this better and found suitable solution? Please anonymous that data if/when needed!

[r_s01]

I am trying to get response on the basis on coming status codes from message.outgoingResponse.istURL, But problem is that there is no field to read return status code from below shared screen shot URL,  is there any way we can get status code as we got from any URL on browser?

Query :-

index="uhcportals-prod-logs" sourcetype=kubernetes container_name="myuhc-sso" logger="com.uhg.myuhc.log.SplunkLog" message.ssoType="Outbound" | spath "message.incomingRequest.partner" | rename message.incomingRequest.partner as "SSO Partner" | search "SSO Partner"=sso_SSOPartner_Amwell | stats count by message.outgoingResponse.istURL

[PickleRick]

1. You're using a very old Splunk version judging by the screenshot.

2. Your initial search is very, very ineffective (Splunk cannot use its index of terms, it has to look through every single event to find your sought for ones)

3. What do you mean by "filter duplicate URL"? You're counting by a triplet - url, status and lob, whatever that is. So you'll get a separate result for each combination of those three values. If you don't want to break it down by status, don't include that field in the BY clause.

[r_s01]

Thanks for response, There is a field called URI some URI is coming as duplicate. how i can adjust query so that duplicate URI won't come? 

[isoutamo]

If you want results by URI then don’t put anything else after by. But then the results is not same as you have with your current query.

....
| stats values(status) as status .... by URI

just replace …. before by with those other fields what you want to see.

But probably this is not what you are looking for?

Can you told what you need to know, not how you try to do it?