How to get unique data?

[Keerthi]

Hi All,

I have a query and the results shows as above. The column function as only single value. I need to get only one value instead of two as the_time also remains same. Can anyone help me to get single value instead of the value repeating twice.

[Keerthi]

Hi Sir,

I tried but still am getting two values.

[ITWhisperer]

Field names are case-sensitive - try using Function instead of function.

(My excuse is that I was unable to accurately copy your image into a text box - in future, it is usually best to use the code block </> option to include SPL or event text so that formatting and typos are reduced.)

[Keerthi]

I tried keeping the case sensitive topic in my mind but it still fetches 2 rows.
i tried using:

|stats first(Function) command to get the first row. But the query when applied to filter does not produce the result.

any help here pls

[ITWhisperer]

If you just want the first event, use this

| head 1

[Keerthi]

Thnaks that worked, but i lately realised one thing that the names ( i mean the spelling) is wrong. is there nay chance to hardcode the value manually in splunk.

HELP PLS!!

[ITWhisperer · Accepted solution]

You could hardcode replacements of incorrect spellings with correct spellings replace function 

[ITWhisperer]

Your SPL is correct for what you are trying to achieve - what may not be "correct" is your data. Does the function have trailing white spaces for example, which makes them look the same but in fact they are different?

You could try trimming the field before the dedup

| savedsearch blah
| fields function
| eval function=trim(function)
| dedup function
| sort function