Splunk Search

How to remove repeated values from my search?

ranjithan
Path Finder

My Query is 

index=windows Type=Disk host IN (abc) FileSystem="*" DriveType="*" Name="*"
| dedup host, Name
| table _time, host, Name
| sort host, Name
| join type=left host [| search index=perfmon source="Perfmon:CPU" object=Processor collection=CPU counter="% Processor Time" instance=_Total
host IN (abc)
| convert num(Value) as value num(pctCPU) as value
| stats avg(value) as "CPUTrend" max(value) as cpu_utz by host
| eval "Max Peak CPU" = round(cpu_utz, 2)
| eval "CPUTrend"=round(CPUTrend, 2)
| fields - cpu_utz
| sort -"Peak CPU"
| rename "Max Peak CPU" AS "maxCPUutil"
| dedup "maxCPUutil"
| table _time, host, "maxCPUutil"]
| table host, "maxCPUutil", Name


I have this below output

host maxCPUutil Name

host                               maxCPUutil       Name
abc                                  5.59                       c:
abc                                  5.59                       E:
abc                                   5.59                       F:

What i want is

my result has multiple hosts.. Not single host. Output should be 

1. abc 35.16 C:
2.                    ‌😧‌

3.                    E:
4. def 45.56 C:
5.                       I:
6.                      J 

Please help me remove the repeated values for drive letter. I need it only once for single host 

Labels (3)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

This one was already asked during last few days. I asked then and I'll ask here again - what's the point?

I understand that you want separate result lines with disk names only - no other fields. How will you be able to tell which host it is from?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Instead of table, use stats:, group by fields you feel the value should be unique, like

| stats values(Name) as Drives by host, "maxCPUutil"

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...