Splunk Search

How to remove repeated values from my search?

ranjithan
Path Finder

My Query is 

index=windows Type=Disk host IN (abc) FileSystem="*" DriveType="*" Name="*"
| dedup host, Name
| table _time, host, Name
| sort host, Name
| join type=left host [| search index=perfmon source="Perfmon:CPU" object=Processor collection=CPU counter="% Processor Time" instance=_Total
host IN (abc)
| convert num(Value) as value num(pctCPU) as value
| stats avg(value) as "CPUTrend" max(value) as cpu_utz by host
| eval "Max Peak CPU" = round(cpu_utz, 2)
| eval "CPUTrend"=round(CPUTrend, 2)
| fields - cpu_utz
| sort -"Peak CPU"
| rename "Max Peak CPU" AS "maxCPUutil"
| dedup "maxCPUutil"
| table _time, host, "maxCPUutil"]
| table host, "maxCPUutil", Name


I have this below output

host maxCPUutil Name

host                               maxCPUutil       Name
abc                                  5.59                       c:
abc                                  5.59                       E:
abc                                   5.59                       F:

What i want is

my result has multiple hosts.. Not single host. Output should be 

1. abc 35.16 C:
2.                    ‌😧‌

3.                    E:
4. def 45.56 C:
5.                       I:
6.                      J 

Please help me remove the repeated values for drive letter. I need it only once for single host 

Labels (3)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

This one was already asked during last few days. I asked then and I'll ask here again - what's the point?

I understand that you want separate result lines with disk names only - no other fields. How will you be able to tell which host it is from?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Instead of table, use stats:, group by fields you feel the value should be unique, like

| stats values(Name) as Drives by host, "maxCPUutil"

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...