Outstanding Contributor.. rtoni1 Outstanding Contributor..
Outstanding Contributor..
335 views

Logger report - suppress duplicates

Hi - I have a simple Logger report setup - using a query object that pulls 2 fields from Cisco events.  I just wanted a quick and dirty report to show current device host names or IP addresses currently reporting into arcsight.

So this report produces a list of device names and IP addresses as expected, but there are lots of duplicates as you might imagine.  So I select the "suppress duplicates" option in the ad hoc report designer thinking this would remove the dup's.  It does not have any effect.  

suppress_duplicates_logger.png

There are probably a dozen ways to do what I want to do, but I'd like to know why the "suppress duplicates" option in the logger report filter does not do anything?  I must be missing something obvious.  Has anyone played with this, can sanity check..?  Thanks..... 

0 Likes
2 Replies
Highlighted
ABader Super Contributor.
Super Contributor.

Re: Logger report - suppress duplicates

Hi,

you can suppress dublicates direct in Report with the group by function in the query.

try this Query.

select
events.arc_deviceHostName,
events.arc_deviceAddress,
events.arc_deviceProduct,
events.arc_deviceVendor
from
events
group by
events.arc_deviceProduct,
events.arc_deviceVendor,
events.arc_deviceHostName,
events.arc_deviceAddress

kind regards.

Andreas

0 Likes
Outstanding Contributor.. rtoni1 Outstanding Contributor..
Outstanding Contributor..

Re: Logger report - suppress duplicates

Hello Andreas, thank you for the reply.  I think I might have messed up on the "group by" part of the query, I will experiment some more.  I appreciate the sanity check....

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.