Splunk Search

Splunk query - update a field with first value of the field

ma_anand1984
Contributor

I'm trying to write a query that converts table 1 to table 2
Basically, i want to retain first value of flower for city-place combination for all rows

Any easiest way to do this?



table1
city   place  flower
NC     A        rose
NC     B        lily
NC     C        sunflower
DE     A        scarlet
DE     B        rose
DE     C        lily     

Table2
city   place  flower
NC     A        rose
NC     B        rose
NC     C        rose
DE     A        scarlet
DE     B        scarlet
DE     C        scarlet

Tags (4)
0 Karma
1 Solution

Ayn
Legend

You could probably use eventstats for this:

... | eventstats first(flower) as flower by city

View solution in original post

Ayn
Legend

You could probably use eventstats for this:

... | eventstats first(flower) as flower by city

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.