Splunk Search

How to remove the row if the column is same?

Wind
New Member

Such as when I using the following search:
sourcetype="xyz" status=* |stats dc(ID) by ID status |sort by ID
I will get the following table
ID status dc(ID)
12345 true 1
12345 false 1
92345 true 1
82345 false 1

Can you tell me how to get the following table?
ID status dc(ID)
12345 true 1
92345 true 1
82345 false 1

That means remove the above second row(When ID is duplicated, remove the row about the "false" column)

Thanks advance for your help.

Tags (3)
0 Karma

neelamssantosh
Contributor

dedup is a expensive command.
so, instead use only ID after by clause section i.e,

sourcetype="xyz" status=* |stats values(status) dc(ID) by ID |sort by ID

0 Karma

Wind
New Member

I have fixed by myself as followings:)
sourcetype="xyz" status=* |stats dc(ID) by ID status |sort ID| sort - status | dedup 1 ID

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...