Splunk Search

How to display few matching entries from table.

ashokqos
Path Finder

Hi,

I have created a table something like this.
Name, Place , Business, Value
Bob, NY, Retail, 1000
Alice, Boston, Transport, 2000
Amit, Delhi, E-commerce, 500
Bob, NY, Entertainment, 1500
Usha, Mumbai, Films, 800
Alice, NY, Films, 5000
Alice, Boston, FastFood, 900

I want to display only those results where a person having 2 different businesses in same city.
Bob, NY, Retail, 1000
Bob, NY, Entertainment, 1500
Alice, Boston, Transport, 2000
Alice, Boston, FastFood, 900

Thanks for your help.

Regards
Ashok

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

View solution in original post

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

ashokqos
Path Finder

Wow!! Thanks a lot. I was trying to achieve the same result using subsearches.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...