Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Help with search query to table single occurrence ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All,
I have table of data as below. I have to fetch single occurrence row. Please Help
Original Table
ID CA Value GrName UsrName DB Name
X1 CA1 CA1 Usr1 …
X2 CA2 CA2 Usr2 …
X2 CA2 CA2 Usr2 …
X3 CA5 CA5 Usr3 …
X3 CA5 CA5 Usr3 …
X3 CA5 CA5 Usr3 …
X4 CA7 CA7 Usr4 …
X4 CA7 CA7 Usr4 …
X5 CA9 CA9 Usr5 …
Desired Result Table
ID CA Value GrName UsrName DB Name
X1 CA1 CA1 Usr1 …
X5 CA9 CA9 Usr5 …
Thanks
Sathish R
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Sathish,
Try the below one.
source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1
This will give you single occurrence of ID field.
Thanks,
L
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Sathish,
Try the below one.
source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1
This will give you single occurrence of ID field.
Thanks,
L
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the workaround.. It Works
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Changwoo.. I need single occurrence row not unique row.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try to use "| dedup ID" search command
Splunk Observability as Code: From Zero to Dashboard
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Shape the Future of Splunk: Join the Product Research Lab!
