I am trying to create a Splunk Alert which -- well, the details will take too long to explain 🙂
The issue is that I'm generating a stats list where some of the results have a single value while others have multiple, e.g.
How do I filter-out the 'resultToToss' based on the fact there's only 1 'SecondaryField' result for it?
you could add a "dc" option ro your stats command, something like this:
your search | stats dc(secondaryField) AS dc_secondaryField values(secondaryField) AS secondaryField BY primaryField | where dc_secondaryField>1
that you can use for your filters.
oh! wow, I didn't know you could do that -- list one of the original fields twice in the stats command 😁 I was seeing the dc(SecondaryField) and assumed that was the only/last reference to that field.
You've unlocked a whole new wave of discovery for me!
You can use mvcount in a where clause to filter out singletons.
| stats list... | where mvcount(SecondaryField)=1