Splunk Search

Help with search query to table single occurrence rows?

rsathish47
Contributor

Hello All,

I have table of data as below. I have to fetch single occurrence row. Please Help

Original Table

ID CA Value GrName UsrName DB Name

X1 CA1 CA1 Usr1 …

X2 CA2 CA2 Usr2 …

X2 CA2 CA2 Usr2 …

X3 CA5 CA5 Usr3 …

X3 CA5 CA5 Usr3 …

X3 CA5 CA5 Usr3 …

X4 CA7 CA7 Usr4 …

X4 CA7 CA7 Usr4 …

X5 CA9 CA9 Usr5 …

Desired Result Table

ID CA Value GrName UsrName DB Name

X1 CA1 CA1 Usr1 …

X5 CA9 CA9 Usr5 …

Thanks

Sathish R

Tags (3)
1 Solution

linu1988
Champion

Hello Sathish,
Try the below one.

source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1

This will give you single occurrence of ID field.

Thanks,
L

View solution in original post

linu1988
Champion

Hello Sathish,
Try the below one.

source=blah.. |stats list(*) as * by ID|eval a=mvcount(CA)|where a=1

This will give you single occurrence of ID field.

Thanks,
L

rsathish47
Contributor

Thanks for the workaround.. It Works

0 Karma

rsathish47
Contributor

Thanks Changwoo.. I need single occurrence row not unique row.

0 Karma

changwoo
Communicator

try to use "| dedup ID" search command

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...