Splunk Search

Remove duplicate rows based on condition

nesa246
Engager

testName values 'VerifyBtagsTest' and  'Test_AcceptTAndCModal' values occurred 2 times wanted to take the latest executed row how do I do this 

base search.....   | table testName Status resultMessage
| where (resultMessage=="null" AND resultMessage != "Test already passed in test plan/run*") OR (Status=="Fail")

 

testName Status executed resultMessage

VerifyBtagsTestFail2020-06-13T18:17:17.701System.NullReferenceException
BonusBalanceTrackingTestFail2020-06-13T18:10:36.249System.NullReferenceException
Test_AcceptTAndCModalFail2020-06-13T18:10:36.249OpenQA.Selenium.NoSuchElementException 
VerifyBtagsTestFail2020-06-13T18:10:36.249OpenQA.Selenium.NoSuchElementException 
BonusBalanceTrackingTestPass2020-06-13T18:17:17.702null
Test_AcceptTAndCModalPass2020-06-13T18:17:17.702null
MarketBannerWithOutcomesFunctionalityTestPass2020-06-13T18:15:50.825null
BasicBannerPromotionTestPass2020-06-13T18:15:30.316null
BelgiumLoadBankingDesktopTestPass2020-06-13T18:15:20.831null
MaltaLoadBankingDesktopTestPass2020-06-13T18:15:13.02null

 

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Assuming you still have the _time field in the base search, then, on the assumption that the where clause test applies to the data prior to evaluating latest, then

 

| where (resultMessage=="null") OR (Status=="Fail")
| table _time testName Status executed resultMessage 
| stats latest(*) as * by testName

 

will pick the latest one for each testName.  If you do not have _time, then you can create time from the 'executed' field with

 

| eval _time=strptime(executed, "%F %T.%Q")

 

 before the table statement.

Note that your original resultMessage test was wrong as it is checking for =="null" AND NOT - so it will always be true, so you will need to correct according to your requirements. I have removed the redundant part above.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the dedup command to remove duplicate events.  It selects the most recent events for each unique value of the given field.

 

base search.....   
| where (resultMessage=="null") OR (Status=="Fail")
| dedup testName
| table testName Status resultMessage

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...