Splunk Search

Identify Unique events across all fields for different time

jsharma33
Observer

Hi,

Below is my result after doing,  xyseries Date_Time,APPROVAL_STATUS,ACT_UW_COUNT

Date_TimeAPPROVEDBACK TO SALESDECLINEDOTHERS
12:46:36260-1991-218-1994-0
13:01:35260-1991-219-2094-0
13:16:35260-1991-219-2094-0
13:31:36260-1991-219-2094-0
13:46:36260-1991-219-2094-0
14:01:36260-1991-219-2094-0
14:16:36260-1991-219-2094-0
14:31:36260-1991-219-2094-0
14:46:36260-1991-219-2094-0
15:01:35261-1993-719-2095-0
15:16:36261-1993-719-2095-0
15:31:36261-1993-719-2095-0
15:46:35261-1993-719-2095-0
16:01:36261-1993-719-2095-0
16:16:36261-1993-719-2095-0
16:31:36261-1993-719-2095-0

 

I want unique records for different approvalstatus w..r.t date_time

expected result

Date_TimeAPPROVEDBACK TO SALESDECLINEDOTHERS
12:46:36260-1991-218-1994-0
15:01:35261-1993-719-2095-0
Labels (3)
0 Karma

to4kawa
Ultra Champion

 

...
| stats first(*) as * by APPROVED

 

Why don't you try stats first() ?

0 Karma
Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...