Splunk Search

How to display few matching entries from table.

ashokqos
Path Finder

Hi,

I have created a table something like this.
Name, Place , Business, Value
Bob, NY, Retail, 1000
Alice, Boston, Transport, 2000
Amit, Delhi, E-commerce, 500
Bob, NY, Entertainment, 1500
Usha, Mumbai, Films, 800
Alice, NY, Films, 5000
Alice, Boston, FastFood, 900

I want to display only those results where a person having 2 different businesses in same city.
Bob, NY, Retail, 1000
Bob, NY, Entertainment, 1500
Alice, Boston, Transport, 2000
Alice, Boston, FastFood, 900

Thanks for your help.

Regards
Ashok

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

View solution in original post

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

ashokqos
Path Finder

Wow!! Thanks a lot. I was trying to achieve the same result using subsearches.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...