Splunk Search

getting the unique value for each row

abhayneilam
Contributor

Hi,

I have a file which contains as follows:

Filed_Name

abhay,murari,chennai
chennai,delhi,chennai
murari,murari,abhay
delhi
chennai,murari

Now, My output should be :

Output_Filed_Name

abhay,murari,chennai
chennai,delhi
murari,abhay
delhi
chennai,murari

For each row, I am removing duplicate values, in second row -- out of 2 chennai, I took only one chennai and in 3rd row,----out of 2 murari, I took only one murari.

Please help !!
Thanks in Advance,

Abhay

Tags (5)
0 Karma

lguinn2
Legend

In my answer, I am assuming that you have a field named outputField which contains "abhay,murari,chennai" exactly like this - a string where commas separate the values. If this is the case, then the following should work

yoursearchhere
| eval outputField=split(outputField,",")
| eval uid = splunk_server +  index +  _cd 
| mvexpand outputField
| dedup outputFiled
| mvcombine delim="," uid

Ayn
Legend

I meant that you have the individual values extracted as fields, so "abhay","murari","chennai" would be individual values, not just one field with "abhay,murari,chennai" as one single value.

0 Karma

abhayneilam
Contributor

yaa this field "Output_Field_Name" is an extracted field. which comes from "table" command

myserch | table fieldone fieldtwo Output_Field_Name

Please help me to achieve this...

0 Karma

Ayn
Legend

Do you have these extracted as fields? If you do, this should be a fairly easy problem to solve. If you don't, then that's what you should focus on solving.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...