Splunk Search

How to remove unique rows from a table? Is there a command opposite to dedup?

MayankSplunk
Path Finder

From my search and transaction command I get the following table. To further process my results, I want to remove the row with ID V3 because it does not exist for type B. Is there a command opposite to dedup?

Type      ID    Score
A         V1     123
B         V1     786
A         V2     45
B         V2     34
A         V3     95
1 Solution

MayankSplunk
Path Finder

Ok found a way to do it

stats count dc(Type) as sourcetypes by ID | search sourcetypes > 1

change sourcetypes > 0 to 1 to remove unique row

View solution in original post

MayankSplunk
Path Finder

Ok found a way to do it

stats count dc(Type) as sourcetypes by ID | search sourcetypes > 1

change sourcetypes > 0 to 1 to remove unique row

MayankSplunk
Path Finder

I have updated the answer.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Wouldn't this keep all the rows?

somesoni2
Revered Legend

This can be achieved in two steps. (may need adjustment per your search)

your search producing above | eventstats count by ID | where count > 1

This will remove all the records where ID appears only once (unique).

MayankSplunk
Path Finder

Thanks @somesoni2 - that works as well.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...