https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47952#M11442 <P>How can I limit my search results to the first event returned?</P> <P>I am trying to define a transaction that starts with an action that is the first event that I am interested in. The issue is that subsequent updates appear as the same action multiple times in the middle fo the transaction. I am not interested in these subsequent events.</P> <P>For example:</P> <P>20100910 09:46:27 FOO ID1</P> <P>20100910 09:46:28 FOO ID1</P> <P>20100910 09:46:29 FOO ID1</P> <P>20100910 09:46:30 FOO ID1</P> <P>20100910 09:46:28 BAR ID1</P> <P>20100910 09:46:29 UP ID1</P> <P>For each unique ID, I want my search to return the first FOO event, the BAR event, and the UP event, and calculate the duration. I want to ignore the additional FOO events. </P> Fri, 10 Sep 2010 20:59:57 GMT ericrobinson 2010-09-10T20:59:57Z https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47952#M11442 <P>How can I limit my search results to the first event returned?</P> <P>I am trying to define a transaction that starts with an action that is the first event that I am interested in. The issue is that subsequent updates appear as the same action multiple times in the middle fo the transaction. I am not interested in these subsequent events.</P> <P>For example:</P> <P>20100910 09:46:27 FOO ID1</P> <P>20100910 09:46:28 FOO ID1</P> <P>20100910 09:46:29 FOO ID1</P> <P>20100910 09:46:30 FOO ID1</P> <P>20100910 09:46:28 BAR ID1</P> <P>20100910 09:46:29 UP ID1</P> <P>For each unique ID, I want my search to return the first FOO event, the BAR event, and the UP event, and calculate the duration. I want to ignore the additional FOO events. </P> Fri, 10 Sep 2010 20:59:57 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47952#M11442 ericrobinson 2010-09-10T20:59:57Z https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47953#M11443 <P>Sounds like the <A href="http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Dedup" rel="nofollow">dedup</A> command is what you're looking for.</P> Fri, 10 Sep 2010 21:12:49 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47953#M11443 southeringtonp 2010-09-10T21:12:49Z https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47954#M11444 <P>That seems to result in only one event being returned as they all have the same ID.. Ill add that the events ate from different sources.</P> Fri, 10 Sep 2010 21:20:48 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47954#M11444 ericrobinson 2010-09-10T21:20:48Z https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47955#M11445 <P>seems you should dedup on action, not id.</P> Fri, 10 Sep 2010 21:28:44 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47955#M11445 gkanapathy 2010-09-10T21:28:44Z https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47956#M11446 <P>Probably something like sourcetype=xxx | dedup action,id | transaction id</P> Fri, 10 Sep 2010 21:53:58 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-limt-my-search-results-to-the-first-event-returned/m-p/47956#M11446 southeringtonp 2010-09-10T21:53:58Z