Splunk Search

How can I hide rows with duplicate values in an xyseries table?

bradj013
Explorer

I have a large table generated by xyseries where most rows have data values that are identical (across the row). I want to hide the rows that have identical values and only show rows where one or more of the values are different or contain the fillnull value (NULL). Consider this xyseries table:

alt text

In this example, the Cows and Horses rows would be hidden because they contain identical data values. Only the Chickens and Pigs rows should be displayed because they have mismatched data values. I have tried dedup but it does not work against the xyseries and it will not catch the missing events where the value is fillnull'ed.

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search just before the xyseries command, say with field animal, barn, count
| eventstats dc(count) as uniqValues by animal | where uniqValues>1
| xyseries animal barn count

View solution in original post

somesoni2
Revered Legend

Try something like this

your current search just before the xyseries command, say with field animal, barn, count
| eventstats dc(count) as uniqValues by animal | where uniqValues>1
| xyseries animal barn count

bradj013
Explorer

No workie 😞

The tail end of my search now looks like this:

| eventstats dc(count) as uniqValues by Object | where uniqValues>1 | xyseries Object computer Version | fillnull value="Missing"

I get no events found when I run this. If I pull out the eventstats and where statements, I get results with duplicates. The object field is made from some strings that are smashed together to give a complete file path. Just for giggles, I created a field called OMD from the md5 sum of the Object field and tweaked your idea accordingly:

| eval OMD=md5(Object) | eventstats dc(count) as uniqValues by OMD | where uniqValues>1 | xyseries Object computer Version | fillnull value="Missing"

Still no results.

0 Karma

somesoni2
Revered Legend

Give this a try

your current search WITH xyseries and fillnull command
| untable Object computer Version
| eventstats dc(Version) as uniqValues by Object | where uniqValues>1
| xyseries Object computer Version | fillnull value="Missing"

bradj013
Explorer

This worked! You rock!

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...