Splunk Search

How to display few matching entries from table.

ashokqos
Path Finder

Hi,

I have created a table something like this.
Name, Place , Business, Value
Bob, NY, Retail, 1000
Alice, Boston, Transport, 2000
Amit, Delhi, E-commerce, 500
Bob, NY, Entertainment, 1500
Usha, Mumbai, Films, 800
Alice, NY, Films, 5000
Alice, Boston, FastFood, 900

I want to display only those results where a person having 2 different businesses in same city.
Bob, NY, Retail, 1000
Bob, NY, Entertainment, 1500
Alice, Boston, Transport, 2000
Alice, Boston, FastFood, 900

Thanks for your help.

Regards
Ashok

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

View solution in original post

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

ashokqos
Path Finder

Wow!! Thanks a lot. I was trying to achieve the same result using subsearches.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...