Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Help with search query to table single occurre...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All,
I have table of data as below. I have to fetch single occurrence row. Please Help
Original Table
ID CA Value GrName UsrName DB Name
X1 CA1 CA1 Usr1 …
X2 CA2 CA2 Usr2 …
X2 CA2 CA2 Usr2 …
X3 CA5 CA5 Usr3 …
X3 CA5 CA5 Usr3 …
X3 CA5 CA5 Usr3 …
X4 CA7 CA7 Usr4 …
X4 CA7 CA7 Usr4 …
X5 CA9 CA9 Usr5 …
Desired Result Table
ID CA Value GrName UsrName DB Name
X1 CA1 CA1 Usr1 …
X5 CA9 CA9 Usr5 …
Thanks
Sathish R
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Sathish,
Try the below one.
source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1
This will give you single occurrence of ID field.
Thanks,
L
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Sathish,
Try the below one.
source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1
This will give you single occurrence of ID field.
Thanks,
L
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the workaround.. It Works
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Changwoo.. I need single occurrence row not unique row.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try to use "| dedup ID" search command
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...
Accelerating Observability as Code with the Splunk AI Assistant
