Splunk Search

How to remove events that have the same field value in the result?

SplunkTrend
New Member

Basically, what I do is extracting the first 3 characters of the host field and show it in a separate field called Place. Now what I want to show is just records having different values in the same event and not show those records that have same value. Any help is appreciated. Thank you.

| stats list(host) AS host, list(Place) AS place by ip

IP               host          place
10.10.20.30      dalerf01      dal
                 dalerf02      dal

30.60.40.50      houl548       hou
                 grfd548       grf
0 Karma

somesoni2
Revered Legend

Try something like this

your base search which gives host, Place, ip | dedup ip Place  | stats list(host) AS host, list(Place) AS place by ip
0 Karma

renjith_nair
Legend

Try

| stats values(host) AS host, values(Place) AS place by ip

OR

Try dedup command

your search |dedup IP host place
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...