filter a table result

[trifledalliance]

Hi - i'm not great at Splunk and am struggling with this one:

I have this search result in table form

Name	Status
Server1	OK
Server2	OK
Server1	Deleted
Server2	OK
Server3	Discovered

I'd like to filter out any servers that have status deleted so for the example i'd like

Name	Status
Server2	OK
Server3	Discovered

Thanks for any help.

[richgalloway · Accepted solution]

Using just the where command to filter results just removes one Server1 event rather than all of them.

Instead, you can use the eventstats command to associated the Deleted status with all events from the same server.  Then filter on that association.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name
| where is_deleted=1
| fields - is_deleted

[trifledalliance]

That works nicely thanks @richgalloway  I just had to tweak the where to get the list of undeleted.

| eventstats count(eval(Status="Deleted")) as is_deleted by Name
| where is_deleted=0 | table Name is_deleted Status