topic Re: How to reverse results of dedup in the same command ? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-reverse-results-of-dedup-in-the-same-command/m-p/324980#M96925 <P>This does not give me the expected result...It is exactly the same problem but reversed...</P> <PRE><CODE>9 - DOWN 4 - UP </CODE></PRE> Wed, 26 Jul 2017 07:46:10 GMT welcominh 2017-07-26T07:46:10Z How to reverse results of dedup in the same command ? https://community.splunk.com/t5/Splunk-Search/How-to-reverse-results-of-dedup-in-the-same-command/m-p/324978#M96923 <P>Im having an issue when trying to dedup some values. Here are the logs of servers states im having in Splunk, from the latest to the oldest</P> <PRE><CODE>1 - UP 2 - UP 3 - UP 4 - UP 5 - DOWN 6 - DOWN 7 - DOWN 8 - DOWN 9 - DOWN </CODE></PRE> <P>When trying to dedup with <CODE>dedup state consecutive=true</CODE> i get the following results :</P> <PRE><CODE>1 - UP 5 - DOWN </CODE></PRE> <P>Is there any way to get instead the following results ?</P> <PRE><CODE>4 - UP 5 - DOWN </CODE></PRE> <P>That is to say the oldest result for UP values, and the latest for DOWN values.</P> <P>Thanks in advance !</P> Tue, 25 Jul 2017 14:01:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reverse-results-of-dedup-in-the-same-command/m-p/324978#M96923 welcominh 2017-07-25T14:01:48Z Re: How to reverse results of dedup in the same command ? https://community.splunk.com/t5/Splunk-Search/How-to-reverse-results-of-dedup-in-the-same-command/m-p/324979#M96924 <P>You can do this</P> <PRE><CODE>your base search giving latest to earliest listing of states | reverse | dedup state consecutive=true </CODE></PRE> <P>OR </P> <PRE><CODE>your base search giving latest to earliest listing of states | dedup state consecutive=true sortby +_time </CODE></PRE> Tue, 25 Jul 2017 17:20:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reverse-results-of-dedup-in-the-same-command/m-p/324979#M96924 somesoni2 2017-07-25T17:20:28Z Re: How to reverse results of dedup in the same command ? https://community.splunk.com/t5/Splunk-Search/How-to-reverse-results-of-dedup-in-the-same-command/m-p/324980#M96925 <P>This does not give me the expected result...It is exactly the same problem but reversed...</P> <PRE><CODE>9 - DOWN 4 - UP </CODE></PRE> Wed, 26 Jul 2017 07:46:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reverse-results-of-dedup-in-the-same-command/m-p/324980#M96925 welcominh 2017-07-26T07:46:10Z