Thanks for the solution, it partially does what I need but still, I need some adjustments as: 1. this keeps all records that are required to be filtered out (removed from the results), I guess it's enough to add NOT after where, am I right? 2. another issue is that it filters out only the records where it's stopped, but is supposed to remove all records of the same host(s), if you look at the first sample result, I've removed the first 2 records, not only the first one with stopped (2nd record with running also should be gone if it has service other than s1) 3. this was not mentioned in my example, but it appeared that there are some other related service names too that contain s1 (e.g. s1v1 or v1s1), so dc(service) doesn't help here as I need something like like(service,"%s1%") (or any better way) within dc() which seems doesn't work Let me create a new sample and the required results: GIVEN: host service state ================= h0 s1v1 stopped h0 v2s1 stopped h1 s1 stopped h1 s2 running h2 s1 stopped h3 s1 running h4 s1 running h4 s2 running h4 s3 stopped RESULTS SHOULD BE: host service state ================= h0 s1v1 stopped h0 v2s1 stopped h2 s1 stopped h3 s1 running h4 s1 running h4 s2 running h4 s3 stopped Explanation: h0's are still there as the services are still related to s1 (contains s1) and they don't have any services other than s1, but h1'a are both gone (not only the first h1 with stopped) Huge thanks in advance for your help, time, and efforts!
... View more