https://community.splunk.com/t5/Getting-Data-In/How-to-extract-only-the-values-that-has-the-same-timestamp-from/m-p/413730#M73198 <P>@danielgp89,</P> <P>Try this and verify if its working for you</P> <PRE><CODE>"your base search"|eventstats dc(MSGNUM) as c by _time|where c&gt;1 </CODE></PRE> <P>This should result only those events which has at least 2 MSGNUM values of same time</P> Sat, 19 Jan 2019 04:43:52 GMT renjith_nair 2019-01-19T04:43:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-only-the-values-that-has-the-same-timestamp-from/m-p/413729#M73197 <P>Hello!</P> <P>I have events from two different fields that are correlate each other by the time.</P> <P>So I want to make a table extracting only those values that were generate at the same time from a range of time of one day. </P> <P>For example in the table below, there are two values that has the same time:</P> <P>How can I extract the events that only has the same timestamp from those two fields (MSGNUM=SVM4000I and SVM4874I)</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6402iACAF883FA9F34153/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 18 Jan 2019 18:07:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-only-the-values-that-has-the-same-timestamp-from/m-p/413729#M73197 danielgp89 2019-01-18T18:07:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-only-the-values-that-has-the-same-timestamp-from/m-p/413730#M73198 <P>@danielgp89,</P> <P>Try this and verify if its working for you</P> <PRE><CODE>"your base search"|eventstats dc(MSGNUM) as c by _time|where c&gt;1 </CODE></PRE> <P>This should result only those events which has at least 2 MSGNUM values of same time</P> Sat, 19 Jan 2019 04:43:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-only-the-values-that-has-the-same-timestamp-from/m-p/413730#M73198 renjith_nair 2019-01-19T04:43:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-only-the-values-that-has-the-same-timestamp-from/m-p/413731#M73199 <P>Thanks so much Renjith!</P> <P>Your going to heaven!</P> Mon, 21 Jan 2019 02:04:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-only-the-values-that-has-the-same-timestamp-from/m-p/413731#M73199 danielgp89 2019-01-21T02:04:20Z