Splunk Search

Splunk query - update a field with first value of the field

ma_anand1984
Contributor

I'm trying to write a query that converts table 1 to table 2
Basically, i want to retain first value of flower for city-place combination for all rows

Any easiest way to do this?



table1
city   place  flower
NC     A        rose
NC     B        lily
NC     C        sunflower
DE     A        scarlet
DE     B        rose
DE     C        lily     

Table2
city   place  flower
NC     A        rose
NC     B        rose
NC     C        rose
DE     A        scarlet
DE     B        scarlet
DE     C        scarlet

Tags (4)
0 Karma
1 Solution

Ayn
Legend

You could probably use eventstats for this:

... | eventstats first(flower) as flower by city

View solution in original post

Ayn
Legend

You could probably use eventstats for this:

... | eventstats first(flower) as flower by city
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...