Splunk Search

Remove duplicate rows based on condition

nesa246
Engager

testName values 'VerifyBtagsTest' and  'Test_AcceptTAndCModal' values occurred 2 times wanted to take the latest executed row how do I do this 

base search.....   | table testName Status resultMessage
| where (resultMessage=="null" AND resultMessage != "Test already passed in test plan/run*") OR (Status=="Fail")

 

testName Status executed resultMessage

VerifyBtagsTestFail2020-06-13T18:17:17.701System.NullReferenceException
BonusBalanceTrackingTestFail2020-06-13T18:10:36.249System.NullReferenceException
Test_AcceptTAndCModalFail2020-06-13T18:10:36.249OpenQA.Selenium.NoSuchElementException 
VerifyBtagsTestFail2020-06-13T18:10:36.249OpenQA.Selenium.NoSuchElementException 
BonusBalanceTrackingTestPass2020-06-13T18:17:17.702null
Test_AcceptTAndCModalPass2020-06-13T18:17:17.702null
MarketBannerWithOutcomesFunctionalityTestPass2020-06-13T18:15:50.825null
BasicBannerPromotionTestPass2020-06-13T18:15:30.316null
BelgiumLoadBankingDesktopTestPass2020-06-13T18:15:20.831null
MaltaLoadBankingDesktopTestPass2020-06-13T18:15:13.02null

 

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Assuming you still have the _time field in the base search, then, on the assumption that the where clause test applies to the data prior to evaluating latest, then

 

| where (resultMessage=="null") OR (Status=="Fail")
| table _time testName Status executed resultMessage 
| stats latest(*) as * by testName

 

will pick the latest one for each testName.  If you do not have _time, then you can create time from the 'executed' field with

 

| eval _time=strptime(executed, "%F %T.%Q")

 

 before the table statement.

Note that your original resultMessage test was wrong as it is checking for =="null" AND NOT - so it will always be true, so you will need to correct according to your requirements. I have removed the redundant part above.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the dedup command to remove duplicate events.  It selects the most recent events for each unique value of the given field.

 

base search.....   
| where (resultMessage=="null") OR (Status=="Fail")
| dedup testName
| table testName Status resultMessage

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...