Such as when I using the following search:
sourcetype="xyz" status=* |stats dc(ID) by ID status |sort by ID
I will get the following table
ID status dc(ID)
12345 true 1
12345 false 1
92345 true 1
82345 false 1
Can you tell me how to get the following table?
ID status dc(ID)
12345 true 1
92345 true 1
82345 false 1
That means remove the above second row(When ID is duplicated, remove the row about the "false" column)
Thanks advance for your help.
dedup is a expensive command.
so, instead use only ID after by clause section i.e,
sourcetype="xyz" status=* |stats values(status) dc(ID) by ID |sort by ID
I have fixed by myself as followings:)
sourcetype="xyz" status=* |stats dc(ID) by ID status |sort ID| sort - status | dedup 1 ID