Getting Data In

how to avoid duplicate events only differ in timestamp

john
Communicator

Hi,

I want to filter the duplicate events from dashboard which only differ in timestamp how its possible.
My log file events are like this.The datas are same but differ by timestamp.How to pick only one event and can show it in dashboard.

[2012-08-02 06:00:58,723] abcdefgggggg
[2012-08-02 06:00:58,724] abcdefgggggg

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

At search time, extract the event body from the timestamp, and use dedup on the field.

example to test:


mysearch | rex "\[\d+-\d+-\d+ \d+:\d+\d+,\d+\](?.*)" | dedup event

yannK
Splunk Employee
Splunk Employee

John, did it worked for you ?

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...