Splunk Search

How to display few matching entries from table.

ashokqos
Path Finder

Hi,

I have created a table something like this.
Name, Place , Business, Value
Bob, NY, Retail, 1000
Alice, Boston, Transport, 2000
Amit, Delhi, E-commerce, 500
Bob, NY, Entertainment, 1500
Usha, Mumbai, Films, 800
Alice, NY, Films, 5000
Alice, Boston, FastFood, 900

I want to display only those results where a person having 2 different businesses in same city.
Bob, NY, Retail, 1000
Bob, NY, Entertainment, 1500
Alice, Boston, Transport, 2000
Alice, Boston, FastFood, 900

Thanks for your help.

Regards
Ashok

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

View solution in original post

somesoni2
Revered Legend

Try something like this

your current search giving first table | eventstats count by Name,Place | where count=2 | fields - count

ashokqos
Path Finder

Wow!! Thanks a lot. I was trying to achieve the same result using subsearches.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...