Splunk Search

Help with search query to table single occurrence rows?

rsathish47
Contributor

Hello All,

I have table of data as below. I have to fetch single occurrence row. Please Help

Original Table

ID CA Value GrName UsrName DB Name

X1 CA1 CA1 Usr1 …

X2 CA2 CA2 Usr2 …

X2 CA2 CA2 Usr2 …

X3 CA5 CA5 Usr3 …

X3 CA5 CA5 Usr3 …

X3 CA5 CA5 Usr3 …

X4 CA7 CA7 Usr4 …

X4 CA7 CA7 Usr4 …

X5 CA9 CA9 Usr5 …

Desired Result Table

ID CA Value GrName UsrName DB Name

X1 CA1 CA1 Usr1 …

X5 CA9 CA9 Usr5 …

Thanks

Sathish R

Tags (3)
1 Solution

linu1988
Champion

Hello Sathish,
Try the below one.

source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1

This will give you single occurrence of ID field.

Thanks,
L

View solution in original post

linu1988
Champion

Hello Sathish,
Try the below one.

source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1

This will give you single occurrence of ID field.

Thanks,
L

rsathish47
Contributor

Thanks for the workaround.. It Works

0 Karma

rsathish47
Contributor

Thanks Changwoo.. I need single occurrence row not unique row.

0 Karma

changwoo
Communicator

try to use "| dedup ID" search command

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...