Splunk Search

How to display few matching entries from table.

ashokqos
Path Finder

Hi,

I have created a table something like this.
Name, Place , Business, Value
Bob, NY, Retail, 1000
Alice, Boston, Transport, 2000
Amit, Delhi, E-commerce, 500
Bob, NY, Entertainment, 1500
Usha, Mumbai, Films, 800
Alice, NY, Films, 5000
Alice, Boston, FastFood, 900

I want to display only those results where a person having 2 different businesses in same city.
Bob, NY, Retail, 1000
Bob, NY, Entertainment, 1500
Alice, Boston, Transport, 2000
Alice, Boston, FastFood, 900

Thanks for your help.

Regards
Ashok

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

View solution in original post

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

ashokqos
Path Finder

Wow!! Thanks a lot. I was trying to achieve the same result using subsearches.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...