Getting Data In

how to avoid duplicate events only differ in timestamp

john
Communicator

Hi,

I want to filter the duplicate events from dashboard which only differ in timestamp how its possible.
My log file events are like this.The datas are same but differ by timestamp.How to pick only one event and can show it in dashboard.

[2012-08-02 06:00:58,723] abcdefgggggg
[2012-08-02 06:00:58,724] abcdefgggggg

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

At search time, extract the event body from the timestamp, and use dedup on the field.

example to test:


mysearch | rex "\[\d+-\d+-\d+ \d+:\d+\d+,\d+\](?.*)" | dedup event

yannK
Splunk Employee
Splunk Employee

John, did it worked for you ?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!