I have a search that will display the OS version of a device and will show me at which location this device is at, right now the search is showing that location multiple times but I do not want any duplicates. Any ideas? Sorry I am a bit rusty with my Splunk!
Here is my search:
index=nitro_prod_iPad | rex "iPad-ip(?[^-]+)" | rex "iOS(?[^-]+)"|table osversion storeNum
Here is some data:
iPad-ip0073-165464457.346545 User-Agent:nitro/1.0.1 (iPad; iOS 10.2; Scale/2.00); Accept-Language:en-US;q=1; True-Client-IP:18.104.22.168;
Basically if it see's it once per storeNum will show the os version and the storeNum then move onto the next storeNum
The table command lists all events; it does not summarize. Try this
index=nitro_prod_iPad | rex "iPad-ip(?[^-]+)" | rex "iOS(?[^-]+)" | stats count by osversion storeNum
I like stats because it both dedups the list and sorts it in a single step.
FYI - the web interface here will delete your "tags" - the open angle brackets, fieldname and close angle brackets - unless you mark them as code before submitting your question, comment or answer.
The "code" button is the one with "101 010" on it.
Also, it doesn't work well in IE, so use Chrome when posting.