I am working on a KPI script and I need to deduplicate lines in the field
Looks like this :
is there an | eval field= substr for first line of field or some regex that can deduplicate my values. Thanks
Are these multi-value fields?
| eval queue=mvindex(queue, 0)
| eval value=mvindex(value, 0)
If not, how did you get the values, perhaps they can be dedup'd before this point?
mvindex works, THANKS! my bash script collects the log, I am still investigating why field gets doubled.
If you are getting these results from stats. You can try using latest function like below. However, it would be easier to address your question if you can share how you got this result.
|stats latest(queue) values(value) by some_other_field
Are these multi-value fields?
| eval queue=mvindex(queue, 0)
| eval value=mvindex(value, 0)
If not, how did you get the values, perhaps they can be dedup'd before this point?