Knowledge Management

How to correct duplicate entries in summary table/report

Path Finder

Dec 24th is the biggest day for us. During the afternoon, a summary job that populates a summary index for sales reports got delayed due to all of the searches that were happening. Consequently the job ran twice during the next hour. So now I have doubled up sales and transaction amounts for that hour.

Is there a way to find and back out the double entries from the summary index?

Labels (1)
0 Karma


If you know the time they were indexed (using the indextime field) you can delete all of the duplicate entries, assuming you meet the prerequisites listed on the page. You could also theoretically get at the duplicate entries with an eventstats command, if you tried something like:

| eventstats count by _raw
| dedup _raw, count
| delete


| filtered search to the exact time/logset of the duplicated logs
| delete

but I can't say for certain without seeing an example duplicated log.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.