Hello all,
I'm not sure I know how to phrase this question properly, but I will try my best.
I'm currently trying to use an external script to remove values from a list being generated by my search. Assuming that I have fields add
and remove
calculated, it's easy to add to the list since all I need to do is use | streamstats current=f values(add) as currentList
and I'll have a running list. Since there is no way to remove values using streamstats (at least that I know of), I'm using an external script to do so:
* | script myScript currentList remove
What I've noticed is that the results being passed to the script are the entire search output, so any removed values in one event are not propagated to successive events. Is there any way of calling the script on an event basis rather than as a post process?
Best regards,
Andrew
Can you just have your search filter those events before returning them?
remove
Instead of
*
Streamstats doesn't remove anything from the search pipeline, it adds to the existing events, so it seems like an inefficient method to accomplish what you're trying.
Can I delete it with this search sentence?
|streamstats count by add|where count>1|delete