Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Help with search query to table single occurre...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All,
I have table of data as below. I have to fetch single occurrence row. Please Help
Original Table
ID CA Value GrName UsrName DB Name
X1 CA1 CA1 Usr1 …
X2 CA2 CA2 Usr2 …
X2 CA2 CA2 Usr2 …
X3 CA5 CA5 Usr3 …
X3 CA5 CA5 Usr3 …
X3 CA5 CA5 Usr3 …
X4 CA7 CA7 Usr4 …
X4 CA7 CA7 Usr4 …
X5 CA9 CA9 Usr5 …
Desired Result Table
ID CA Value GrName UsrName DB Name
X1 CA1 CA1 Usr1 …
X5 CA9 CA9 Usr5 …
Thanks
Sathish R
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Sathish,
Try the below one.
source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1
This will give you single occurrence of ID field.
Thanks,
L
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Sathish,
Try the below one.
source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1
This will give you single occurrence of ID field.
Thanks,
L
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the workaround.. It Works
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Changwoo.. I need single occurrence row not unique row.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try to use "| dedup ID" search command
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Observability Simplified: Combining User Experience, Application Performance & ...
Event Series May & June: From Network Visibility to Service Intelligence
Global Splunk User Group Events: May + June 2026
