I have a search that will display the OS version of a device and will show me at which location this device is at, right now the search is showing that location multiple times but I do not want any duplicates. Any ideas? Sorry I am a bit rusty with my Splunk!
Here is my search:
index=nitro_prod_iPad | rex "iPad-ip(?[^-]+)" | rex "iOS(?[^-]+)"|table osversion storeNum
Here is some data:
iPad-ip0073-165464457.346545
User-Agent:nitro/1.0.1 (iPad; iOS 10.2; Scale/2.00);
Accept-Language:en-US;q=1;
True-Client-IP:35.222.222.21;
Basically if it see's it once per storeNum will show the os version and the storeNum then move onto the next storeNum
try this
index=nitro_prod_iPad
| rex "iPad-ip(?<storeNum>[^-]+)"
| rex "iOS(?<osversion>[^-]+)"
| table osversion storeNum
| dedup
You might also be interested in
...|stats latest(osversion) latest(storeNum)
Which would show the latest value of each.
The table command lists all events; it does not summarize. Try this
index=nitro_prod_iPad | rex "iPad-ip(?[^-]+)" | rex "iOS(?[^-]+)" | stats count by osversion storeNum
I like stats because it both dedups the list and sorts it in a single step.
try this
index=nitro_prod_iPad
| rex "iPad-ip(?<storeNum>[^-]+)"
| rex "iOS(?<osversion>[^-]+)"
| table osversion storeNum
| dedup
FYI - the web interface here will delete your "tags" - the open angle brackets, fieldname and close angle brackets - unless you mark them as code before submitting your question, comment or answer.
The "code" button is the one with "101 010" on it.
Also, it doesn't work well in IE, so use Chrome when posting.