Hi @ylucena,
One way to filter out already defined data is to use streamstats combined with evals.
First thing to do is sort the table by Host, interface, ip_address and OS.
Then you can compare each row with the value of the previous row. If they are the same as the previous line, then change the value to "".
|...previous search here...
| sort Host, interface, ip_address, OS
| streamstats current=false last(Host) as prev_host, last(interface) as prev_interface, last(ip_address) as prev_ipaddress
| eval Host=if(Host==prev_host,"",Host)
| eval interface=if(Host=="" AND interface == prev_interface,"",interface)
| eval ip_address=if(Host=="" AND interface=="" AND ip_address==prev_ipaddress,"",ip_address)
| table Host, interface, ip_address, OS
Checks:
- This search checks the Host to see if it's the same as the last one, and if so sets it to "".
- Next it looks at the Interface - if the host is already set to "" and the interface is the same as the last one, then it sets the interface to "".
- Finally, a similar check is done for ip_address. As long as the Host and interface are blank, it will set the ip_address to "" if it's the same as the previous one.
- In all other cases the fields are left as-is.
That results it the following:
Cheers,
Daniel
