SerialNumber | Duration |
111A | 200 |
111A | 500 |
2222 | 300 |
3333 | 100 |
3333 | 250 |
How can I display only the lowest duration for each SerialNumber.
| dedup SerialNumber would sometimes get me the larger duration.
Expected Output:
SerialNumber | Duration |
111A | 200 |
2222 | 300 |
3333 | 100 |
Try
YOUR_SEARCH | stats min(Duration) as Duration by SerialNumber
My Sample Search :
| makeresults | eval _raw="SerialNumber Duration
111A 200
111A 500
2222 300
3333 100
3333 250"| multikv forceheader=1 | stats min(Duration) as Duration by SerialNumber
KV