Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

choose top string for a group

$
0
0

So, my data looks like this:

code message hash count
aaa  m1      53e  3
aaa  m2      53e  5
bbb  m3      54e  15
ccc  m4      77f  4
ccc  m5      77f  7

and I want to group by the hash (actually I could group by either the hash or the code), and choose any of the messages in the resulting bucket. Here is my desired output:

code message hash count
aaa  m1      53e  8
bbb  m3      54e  15
ccc  m4      77f  11

Note that I don't care in the first group whether m1 or m2 is displayed. Also, the messages are strings, not numerical data. Any ideas how I can achieve what I want?


Viewing all articles
Browse latest Browse all 13053

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>