https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341190#M161289 <P>Use the <CODE>dedup</CODE> command.</P> <PRE><CODE>... | dedup Server Status | ... </CODE></PRE> Fri, 21 Apr 2017 13:33:34 GMT richgalloway 2017-04-21T13:33:34Z https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341189#M161288 <P>I would like to count the number of times a Server went down based on up/down status field.<BR /> How can i evaluate multiple(continuous) <CODE>down</CODE> into one <CODE>down</CODE> status, when i am receiving events every five minutes?<BR /> Multiple(continuous) <CODE>down</CODE> for one host should be treated as one <CODE>down</CODE>.</P> <P><STRONG>Time| Server |Status</STRONG><BR /> 3:00 AM Host1 up<BR /> 3:00 PM Host2 down<BR /> 3:05 PM Host1 up<BR /> 3:10 PM Host1 up<BR /> 3:15 PM Host1 down<BR /> 3:15 PM Host2 up<BR /> 3:20 PM Host1 up<BR /> 3:25 PM Host1 down<BR /> 3:30 PM Host1 up<BR /> 3:35 PM Host1 up<BR /> 3:40 PM Host1 down<BR /> 3:45 PM Host1 down</P> Fri, 21 Apr 2017 12:47:32 GMT https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341189#M161288 biec1 2017-04-21T12:47:32Z https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341190#M161289 <P>Use the <CODE>dedup</CODE> command.</P> <PRE><CODE>... | dedup Server Status | ... </CODE></PRE> Fri, 21 Apr 2017 13:33:34 GMT https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341190#M161289 richgalloway 2017-04-21T13:33:34Z https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341191#M161290 <P>How can this help me to get the number of the times the server went down in a week?</P> <PRE><CODE>index=index_names source="rest://" (server="host1" OR server="host2") | stats latest(_time) as Time values(server_state) as status by server _time | dedup server status </CODE></PRE> Fri, 21 Apr 2017 14:11:19 GMT https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341191#M161290 biec1 2017-04-21T14:11:19Z https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341192#M161291 <P>Your question was how to evaluate multiple instances of a status value to a single instance. The <CODE>dedup</CODE> command does exactly that.<BR /> That doesn't tell you how many times a server went down, just the last time the status changed to Up or Down.</P> Fri, 21 Apr 2017 14:17:24 GMT https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341192#M161291 richgalloway 2017-04-21T14:17:24Z https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341193#M161292 <P>I would like to retrieve the number of times a server went down.</P> Fri, 21 Apr 2017 17:02:32 GMT https://community.splunk.com/t5/Splunk-Search/Evaluate-multiple-events-with-same-data/m-p/341193#M161292 biec1 2017-04-21T17:02:32Z