Say I have a table ...
host, IP, destinationHostname, Port, count
host1 10.10.10.1 desthost1 9999, 33
host1 10.10.10.2 desthost2 9998, 33
host1 10.10.10.3 desthost3 9997, 34
host2 10.10.10.1 desthost1 9999, 88
host3 10.10.10.2 desthost2 9995, 100
host3 10.10.10.4 desthost4 9990, 10
I'd like to remove the host field where it appears multiple times ...
So, I want my output to look like this ... ( essentially ... where host1 repeats I just want it gone )
host1 10.10.10.1 desthost1 9999, 33
10.10.10.2 desthost2 9998, 33
10.10.10.3 desthost3 9997, 34
host2 10.10.10.1 desthost1 9999, 88
host3 10.10.10.2 desthost2 9995, 100
10.10.10.4 desthost4 9990, 10
Is that even possible?
The last element of my search is simply |table host, IP, destinationHostname, Port, count
| stats values(IP), values(distinationHostname), values(Port), count by host
| stats values(IP), values(distinationHostname), values(Port), count by host
This was exactly what I needed. Thank you!
@pkeller please mark as accepted 🙂
done. When I checked earlier, the 'accept' action wasn't rendering itself. Thanks for the reminder. 😎