Splunk Search

How to delete the repeated rows and only keep the values that have a reason?

crmarley20
Explorer

Hello,

Please I need your help,  I have a dedup with a conditional.

It happens that I have this table where when the technician enters the reason for its technical service is saved in splunk its previous value and the new change.

I need to delete the repeated rows and only keep the values that have a reason written by the technician.

crmarley20_1-1644398464341.png

 

Labels (7)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @crmarley20,

let me understand: you want that only the last comment is displayed in the table, is it correct?

if this is your need, you could run something like this:

your_search
| stats last(grund) AS grund BY start end technician

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @crmarley20,

let me understand: you want that only the last comment is displayed in the table, is it correct?

if this is your need, you could run something like this:

your_search
| stats last(grund) AS grund BY start end technician

Ciao.

Giuseppe

0 Karma

crmarley20
Explorer

I solved it, thank you very much for your support.

In my real case I have more columns so what I have done is to sort each row by Begin End and the error number (it happens that the error number of the message "Techn. did not write" is 8000000 while the type of reason have error numbers less than 100. With the data sorted, I applied dedup with the Begin End and Technician fields.

Thank you very much for your help. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @crmarley20,

good for you, see next time!

Please accept my answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

crmarley20
Explorer

It does not always work, I have tested it in my real case and it does not work well. Is there another solution?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @crmarley20,

what do you mean with "It does not always work", what's the wrong result you have?

Probably there's omething different in the real data you have.

could you better describe the situation?

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...