Splunk Search

Splunk query - update a field with first value of the field

ma_anand1984
Contributor

I'm trying to write a query that converts table 1 to table 2
Basically, i want to retain first value of flower for city-place combination for all rows

Any easiest way to do this?



table1
city   place  flower
NC     A        rose
NC     B        lily
NC     C        sunflower
DE     A        scarlet
DE     B        rose
DE     C        lily     

Table2
city   place  flower
NC     A        rose
NC     B        rose
NC     C        rose
DE     A        scarlet
DE     B        scarlet
DE     C        scarlet

Tags (4)
0 Karma
1 Solution

Ayn
Legend

You could probably use eventstats for this:

... | eventstats first(flower) as flower by city

View solution in original post

Ayn
Legend

You could probably use eventstats for this:

... | eventstats first(flower) as flower by city
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...