Remove identical events and keep the latest in the dashboard without using dedup

[sai91603]

Hi ,

I am creating a dashboard where it should show the time difference between two latest events, since all the events look alike, I do not want splunk to pickup the old events timestamps and compare with the new one.

I tried using dedup and it is showing only for one particular day even though I selected a range of dates.

Query:

index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| bucket _time span=1d as day
| stats earliest(_time) as First latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - First))
| eval day=strftime(day,"%m/%d/%y")
| eval Last=strftime(Last,"%S")
| eval First=strftime(First,"%S")
| rename Last as "Last_ss"
| rename First as "First_ss"
| rename DurationInMinutesDeci as Seconds
| rename _time as exacttime
| rename day as _time
| table _time, Seconds

[ITWhisperer]

Not entirely sure what you are trying to do here

index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| bucket _time span=1d as day
| stats earliest(_time) as First latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - First))
| eval day=strftime(day,"%m/%d/%y")
| eval Last=strftime(Last,"%S")
| eval First=strftime(First,"%S")
| rename Last as "Last_ss"
| rename First as "First_ss"
| rename DurationInMinutesDeci as Seconds
| rename _time as exacttime
| rename day as _time
| table _time, Seconds

The highlighted line are the only ones which seem relevant. What you should be getting is the number of second between the first event of the day and the last event of the day for each day in the index which matches the search. Is this what you were expecting?

[sai91603]

Thanks for the response @ITWhisperer .
No, i need the time difference between the last two events(latest events). 
Means  if i have two  events in the morning, which is similar to two events in the afternoon, I need to calculate the time difference between the latest events(afternoon events)

I can provide you with the logs if you didn’t get it and thanks for correcting the query.

[ITWhisperer · Accepted solution]

index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| sort _time
| streamstats window=1 current=false values(_time) as previous_time
| bucket _time span=1d as day
| stats latest(previous_time) as Previous latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - Previous))
| eval day=strftime(day,"%m/%d/%y")
| rename DurationInMinutesDeci as Seconds
| rename day as _time
| table _time, Seconds

[sai91603]

Thanks @ITWhisperer ,it's working like a charm.