Splunk Search

Identify Unique events across all fields for different time

jsharma33
Observer

Hi,

Below is my result after doing,  xyseries Date_Time,APPROVAL_STATUS,ACT_UW_COUNT

Date_TimeAPPROVEDBACK TO SALESDECLINEDOTHERS
12:46:36260-1991-218-1994-0
13:01:35260-1991-219-2094-0
13:16:35260-1991-219-2094-0
13:31:36260-1991-219-2094-0
13:46:36260-1991-219-2094-0
14:01:36260-1991-219-2094-0
14:16:36260-1991-219-2094-0
14:31:36260-1991-219-2094-0
14:46:36260-1991-219-2094-0
15:01:35261-1993-719-2095-0
15:16:36261-1993-719-2095-0
15:31:36261-1993-719-2095-0
15:46:35261-1993-719-2095-0
16:01:36261-1993-719-2095-0
16:16:36261-1993-719-2095-0
16:31:36261-1993-719-2095-0

 

I want unique records for different approvalstatus w..r.t date_time

expected result

Date_TimeAPPROVEDBACK TO SALESDECLINEDOTHERS
12:46:36260-1991-218-1994-0
15:01:35261-1993-719-2095-0
Labels (3)
0 Karma

to4kawa
Ultra Champion

 

...
| stats first(*) as * by APPROVED

 

Why don't you try stats first() ?

0 Karma
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...