How to delete the repeated rows and only keep the values that have a reason?

[crmarley20]

Hello,

Please I need your help,  I have a dedup with a conditional.

It happens that I have this table where when the technician enters the reason for its technical service is saved in splunk its previous value and the new change.

I need to delete the repeated rows and only keep the values that have a reason written by the technician.

[gcusello · Accepted solution]

Hi @crmarley20,

let me understand: you want that only the last comment is displayed in the table, is it correct?

if this is your need, you could run something like this:

your_search
| stats last(grund) AS grund BY start end technician

Ciao.

Giuseppe

[crmarley20]

I solved it, thank you very much for your support.

In my real case I have more columns so what I have done is to sort each row by Begin End and the error number (it happens that the error number of the message "Techn. did not write" is 8000000 while the type of reason have error numbers less than 100. With the data sorted, I applied dedup with the Begin End and Technician fields.

Thank you very much for your help. 

[gcusello]

Hi @crmarley20,

good for you, see next time!

Please accept my answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[crmarley20]

It does not always work, I have tested it in my real case and it does not work well. Is there another solution?

[gcusello]

Hi @crmarley20,

what do you mean with "It does not always work", what's the wrong result you have?

Probably there's omething different in the real data you have.

could you better describe the situation?

Ciao.

Giuseppe