Getting Data In

how to avoid duplicate events only differ in timestamp

john
Communicator

Hi,

I want to filter the duplicate events from dashboard which only differ in timestamp how its possible.
My log file events are like this.The datas are same but differ by timestamp.How to pick only one event and can show it in dashboard.

[2012-08-02 06:00:58,723] abcdefgggggg
[2012-08-02 06:00:58,724] abcdefgggggg

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

At search time, extract the event body from the timestamp, and use dedup on the field.

example to test:


mysearch | rex "\[\d+-\d+-\d+ \d+:\d+\d+,\d+\](?.*)" | dedup event

yannK
Splunk Employee
Splunk Employee

John, did it worked for you ?

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...