Getting Data In

how to avoid duplicate events only differ in timestamp

john
Communicator

Hi,

I want to filter the duplicate events from dashboard which only differ in timestamp how its possible.
My log file events are like this.The datas are same but differ by timestamp.How to pick only one event and can show it in dashboard.

[2012-08-02 06:00:58,723] abcdefgggggg
[2012-08-02 06:00:58,724] abcdefgggggg

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

At search time, extract the event body from the timestamp, and use dedup on the field.

example to test:


mysearch | rex "\[\d+-\d+-\d+ \d+:\d+\d+,\d+\](?.*)" | dedup event

yannK
Splunk Employee
Splunk Employee

John, did it worked for you ?

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...