Splunk Search

How to filter out specific rows in a table based on column values?

parizanov
New Member

Hello,

I have a table like the one below, with a column containing repeated id numbers form one side and respective messages for each id on the other side. I want to make a search which can show the id numbers that have only "Error" message as value and skip repeating ids that have Error and OK. Any help is much appreciated.

col1       col2
11111      Error
11111      OK
55555      Error

In the example, successful query should return 55555.

Tags (4)
0 Karma
1 Solution

sundareshr
Legend

Try this

base search | chart count over col1 by col2 | where col2=0

*OR*

base search | eventstats values(col2) as status by col1 | where isnull(mvfind(status, "OK"))

View solution in original post

0 Karma

sundareshr
Legend

Try this

base search | chart count over col1 by col2 | where col2=0

*OR*

base search | eventstats values(col2) as status by col1 | where isnull(mvfind(status, "OK"))
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...