How to edit my search to display the OS version of a device and the location?

[JoshuaJohn]

I have a search that will display the OS version of a device and will show me at which location this device is at, right now the search is showing that location multiple times but I do not want any duplicates. Any ideas? Sorry I am a bit rusty with my Splunk!

Here is my search:

index=nitro_prod_iPad | rex "iPad-ip(?[^-]+)" | rex "iOS(?[^-]+)"|table osversion storeNum

Here is some data:

iPad-ip0073-165464457.346545 
User-Agent:nitro/1.0.1 (iPad; iOS 10.2; Scale/2.00);
Accept-Language:en-US;q=1;
True-Client-IP:35.222.222.21;

Basically if it see's it once per storeNum will show the os version and the storeNum then move onto the next storeNum

[jkat54]

You might also be interested in

...|stats latest(osversion) latest(storeNum)

Which would show the latest value of each.

[lguinn2]

The table command lists all events; it does not summarize. Try this

index=nitro_prod_iPad | rex "iPad-ip(?[^-]+)" | rex "iOS(?[^-]+)" | stats count by osversion storeNum

I like stats because it both dedups the list and sorts it in a single step.

[DalJeanis · Accepted solution]

try this

index=nitro_prod_iPad 
| rex "iPad-ip(?<storeNum>[^-]+)" 
| rex "iOS(?<osversion>[^-]+)"
| table osversion storeNum
| dedup

[DalJeanis]

FYI - the web interface here will delete your "tags" - the open angle brackets, fieldname and close angle brackets - unless you mark them as code before submitting your question, comment or answer.

The "code" button is the one with "101 010" on it.

Also, it doesn't work well in IE, so use Chrome when posting.