I want to filter the duplicate events from dashboard which only differ in timestamp how its possible.
My log file events are like this.The datas are same but differ by timestamp.How to pick only one event and can show it in dashboard.
[2012-08-02 06:00:58,723] abcdefgggggg
[2012-08-02 06:00:58,724] abcdefgggggg
At search time, extract the event body from the timestamp, and use dedup on the field.
example to test:
mysearch | rex "\[\d+-\d+-\d+ \d+:\d+\d+,\d+\](?.*)" | dedup event
John, did it worked for you ?