https://community.splunk.com/t5/Splunk-Search/How-to-find-the-last-regex-match-for-a-multi-valued-field-in-a/m-p/63692#M15742 <P>over all events. But if you do a </P> <P>... | dedup hash _time | ...</P> <P>you'll dedup the combination of the fields, so in this case you'll get one hash per bucket of time.</P> <P>/K</P> Mon, 17 Jun 2013 19:56:06 GMT kristian_kolb 2013-06-17T19:56:06Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-last-regex-match-for-a-multi-valued-field-in-a/m-p/63689#M15739 <P>We're finding that when large files are downloaded from the Internet, the application whitelisting client reports a "new file" with a different hash multiple times as the download completes.</P> <P>I essentially want to dedup the events by host, file, path but only over a very limited time window (like 5 minutes). If I use transaction to group those events and it puts the values of the file hash in a multi-value field (in time order, not sort order I believe), how do I extract just that last hash?</P> <P>Or is there some way to combine dedup and bins or something like that.</P> <P>Thanks.</P> <P>C</P> Fri, 14 Jun 2013 01:13:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-last-regex-match-for-a-multi-valued-field-in-a/m-p/63689#M15739 responsys_cm 2013-06-14T01:13:32Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-last-regex-match-for-a-multi-valued-field-in-a/m-p/63690#M15740 <P>How about using <CODE>bucket</CODE> (aka <CODE>bin</CODE>) and <CODE>stats</CODE> instead?</P> <PRE><CODE>... | bucket _time span=5m | stats last(hash) by _time </CODE></PRE> <P>If you still want to go the <CODE>transaction</CODE> / mvfield route you could probably reach some success by using <CODE>eval</CODE>'s <CODE>mvindex</CODE> function (an index of "-1" returns the last item in the list).</P> Fri, 14 Jun 2013 06:09:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-last-regex-match-for-a-multi-valued-field-in-a/m-p/63690#M15740 Ayn 2013-06-14T06:09:00Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-last-regex-match-for-a-multi-valued-field-in-a/m-p/63691#M15741 <P>Thanks, Ayn! Quick question, if I run dedup after the bucket command, will Splunk only dedup events in each bucket or will it dedup over all events?</P> Mon, 17 Jun 2013 19:39:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-last-regex-match-for-a-multi-valued-field-in-a/m-p/63691#M15741 responsys_cm 2013-06-17T19:39:03Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-last-regex-match-for-a-multi-valued-field-in-a/m-p/63692#M15742 <P>over all events. But if you do a </P> <P>... | dedup hash _time | ...</P> <P>you'll dedup the combination of the fields, so in this case you'll get one hash per bucket of time.</P> <P>/K</P> Mon, 17 Jun 2013 19:56:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-last-regex-match-for-a-multi-valued-field-in-a/m-p/63692#M15742 kristian_kolb 2013-06-17T19:56:06Z