topic Re: Summary Index has Duplicates in Knowledge Management

Summary Index has Duplicates

aohls — Thu, 05 Sep 2019 12:45:41 GMT

I have a search I created that runs for the last 5 minutes. I scheduled this to run every 5 minutes to update a summary index I have. I am finding duplicates on my data. Is there a better way to manage the run times to make sure there are no duplicates? I am only putting a table into the summary, there are no stat commands. Is there some way to handle this better?

Re: Summary Index has Duplicates

gcusello — Thu, 05 Sep 2019 13:21:55 GMT

Hi aohls,
are your duplicates only in the last seconds of the five minutes or in all the period?
if duplicates are only in the last period, you could insert in your main search a subsearch from the summary index excluding events alreadi indexed, in other words something like this:

index=my_index NOT [ search my_symmaty_index | fields _time field1 field2 field3 ]
| table _time field1 field2 field3 
| collect index=my_summary_index

If instead are in a larger period, you should analyze again you data and your search.

Bye.
Giuseppe

Re: Summary Index has Duplicates

aohls — Mon, 16 Sep 2019 12:10:00 GMT

I had created a field extraction not realizing that happened automatically; this caused duplicate results.