How do I filter-out the 'resultToToss' based on the fact there's only 1 'SecondaryField' result for it?

[ttovarzoll]

I am trying to create a Splunk Alert which -- well, the details will take too long to explain 🙂

The issue is that I'm generating a stats list where some of the results have a single value while others have multiple, e.g.

PrimaryField	SecondaryField
resultToKeep	result1 result2
resultToToss	result1

How do I filter-out the 'resultToToss' based on the fact there's only 1 'SecondaryField' result for it?

[gcusello]

Hi @ttovarzoll,

you could add a "dc" option ro your stats command, something like this:

your search
| stats dc(secondaryField) AS dc_secondaryField values(secondaryField) AS secondaryField BY primaryField
| where dc_secondaryField>1

that you can use for your filters.

Ciao.

Giuseppe

[ttovarzoll]

Giuseppe,

Thanks, that's a great trick! But wouldn't it lose the original values of SecondaryField?

[gcusello]

Hi @ttovarzoll,

if you add (as hinted in my solution) the "values(secondaryField) AS secondaryField" option in the stats command, you don't lose it.

Ciao and happy splunking.

Giuseppe

[ttovarzoll]

oh! wow, I didn't know you could do that -- list one of the original fields twice in the stats command 😁 I was seeing the dc(SecondaryField) and assumed that was the only/last reference to that field.

You've unlocked a whole new wave of discovery for me!

[richgalloway]

You can use mvcount in a where clause to filter out singletons.

| stats list...
| where mvcount(SecondaryField)=1

[VatsalJagani · Accepted solution]

@ttovarzoll - it would be >1

| where mvcount(SecondaryField)>1