Splunk Search

How do I edit my search to remove duplicates of a field that appear in a table column?

pkeller
Contributor

Say I have a table ...

host, IP, destinationHostname, Port, count

host1 10.10.10.1 desthost1 9999, 33
host1 10.10.10.2 desthost2 9998, 33
host1 10.10.10.3 desthost3 9997, 34
host2 10.10.10.1 desthost1 9999, 88
host3 10.10.10.2 desthost2 9995, 100
host3 10.10.10.4 desthost4 9990, 10

I'd like to remove the host field where it appears multiple times ...

So, I want my output to look like this ... ( essentially ... where host1 repeats I just want it gone )

host1 10.10.10.1 desthost1 9999, 33
      10.10.10.2 desthost2 9998, 33
      10.10.10.3 desthost3 9997, 34
host2 10.10.10.1 desthost1 9999, 88
host3 10.10.10.2 desthost2 9995, 100
      10.10.10.4 desthost4 9990, 10

Is that even possible?

The last element of my search is simply |table host, IP, destinationHostname, Port, count

Tags (3)
0 Karma
1 Solution

pradeepkumarg
Influencer
| stats values(IP), values(distinationHostname), values(Port), count by host

View solution in original post

pradeepkumarg
Influencer
| stats values(IP), values(distinationHostname), values(Port), count by host

pkeller
Contributor

This was exactly what I needed. Thank you!

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

@pkeller please mark as accepted 🙂

pkeller
Contributor

done. When I checked earlier, the 'accept' action wasn't rendering itself. Thanks for the reminder. 😎

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...