topic Re: Multiple Timestamps - How to filter/select? in Splunk Search

Multiple Timestamps - How to filter/select?

sarge338 — Tue, 26 Aug 2025 14:51:42 GMT

Good day!

I am currently working on a search which provides data from two different event types (connection information and disposition information). Everything is working well, except both event types have timestamps with the same name. As a result, my returned data has two timestamps (in the same column) for each record.

Is there a way to limit the number of timestamps per record to 1? Or is there a way to somehow designate which event type the timestamp should be pulled from?

Thank you for your help!

Re: Multiple Timestamps - How to filter/select?

gcusello — Tue, 26 Aug 2025 14:56:09 GMT

Hi @sarge338 ,

yes, it's poossible to have one value for each column, but could you share your search?

otherwise it's difficoult to give a correct answer!

in general, you could display only one of the values in the timestamp column ore rename one of the fields, but I need your search to help you.

Ciao.

Giuseppe

Re: Multiple Timestamps - How to filter/select?

sarge338 — Tue, 26 Aug 2025 15:25:24 GMT

Hey Giuseppe! Thanks for the quick response. Below is my current SPL.

The "guid" field is what ties both event-types together for a single connection.

index="connection_data" | stats values("connections{}.left.facets{}.number") as sourcenumber values("connections{}.left.facets{}.country") as sourcecountry values("connections{}.right.facets{}.number") as destinationnumber values("connections{}.right.facets{}.country") as destinationcountry values("meta") as direction values("id") as policyrule values("disposition.disposition") as disposition values("resourceId") as router values("timestampStr") as timestamp by guid | eval sourcenumber=mvdedup(sourcenumber) | eval destinationregion=mvdedup(destinationregion) | eval destination_rc=mvdedup(destination_rc) | eval destinationcountry=mvdedup(destinationcountry) | eval destinationnumber=mvdedup(destinationnumber) | eval calldisposition=mvdedup(calldisposition) | where disposition="TERMINATED" | table timestamp guid sourcenumber sourcecountry destinationnumber destinationcountry direction router disposition

Re: Multiple Timestamps - How to filter/select?

sarge338 — Tue, 26 Aug 2025 16:12:35 GMT

Hey Giuseppe! Thanks for the quick response. Below is my current SPL.

The "guid" field is what ties both event-types together for a single connection.

Seems I responded to myself first...

Re: Multiple Timestamps - How to filter/select?

yuanliu — Wed, 27 Aug 2025 02:20:57 GMT

Thank you for clarifying your question with mock code.

Is there a way to limit the number of timestamps per record to 1? Or is there a way to somehow designate which event type the timestamp should be pulled from?

First, are teh two values of timestampStr represent the same time? If yes, the answer is easy. Just use the value.

If the two strings are different, only YOU can answer the question correctly. What is the logic of using one vs the other? Is one "better" than the other? If it doesn't matter which, you can use first(timestampStr), last(timestampStr), earliest(timestampStr), latest(timestampStr), or any number of stats functions that yields a single value.

However, if you have a preference, you must describe your preference before any volunteer can help here.

Re: Multiple Timestamps - How to filter/select?

ITWhisperer — Wed, 27 Aug 2025 06:06:36 GMT

Most of the eval commands with the mvdedup() functions are superfluous as values() functions in the the prior stats command already dedups the values returned in these fields.