Splunk Search

getting the unique value for each row

abhayneilam
Contributor

Hi,

I have a file which contains as follows:

Filed_Name

abhay,murari,chennai
chennai,delhi,chennai
murari,murari,abhay
delhi
chennai,murari

Now, My output should be :

Output_Filed_Name

abhay,murari,chennai
chennai,delhi
murari,abhay
delhi
chennai,murari

For each row, I am removing duplicate values, in second row -- out of 2 chennai, I took only one chennai and in 3rd row,----out of 2 murari, I took only one murari.

Please help !!
Thanks in Advance,

Abhay

Tags (5)
0 Karma

lguinn2
Legend

In my answer, I am assuming that you have a field named outputField which contains "abhay,murari,chennai" exactly like this - a string where commas separate the values. If this is the case, then the following should work

yoursearchhere
| eval outputField=split(outputField,",")
| eval uid = splunk_server +  index +  _cd 
| mvexpand outputField
| dedup outputFiled
| mvcombine delim="," uid

Ayn
Legend

I meant that you have the individual values extracted as fields, so "abhay","murari","chennai" would be individual values, not just one field with "abhay,murari,chennai" as one single value.

0 Karma

abhayneilam
Contributor

yaa this field "Output_Field_Name" is an extracted field. which comes from "table" command

myserch | table fieldone fieldtwo Output_Field_Name

Please help me to achieve this...

0 Karma

Ayn
Legend

Do you have these extracted as fields? If you do, this should be a fairly easy problem to solve. If you don't, then that's what you should focus on solving.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...