Splunk Search

Dedup within a time range

eolg
New Member

I need to chart the sum of the values of a field by the value of another field over time (e.g. the sum of values of field A for all events that share the same value for field B). However, there is also a third field (field C), and if two events have same value for field C, I don't want them both included in the sum.

Generally, events with the same value for field C will be logged in Splunk at 2 minute intervals, but creating a timechart with a span of 2 minutes doesn't work perfectly because the time can be slightly more or less than 2 minutes. Is there a way to dedup events with the same field C within a certain time range? Or any other way to achieve this?

0 Karma
1 Solution

HiroshiSatoh
Champion
(your search)|bin span=2m _time|dedup _time,field_C

Can you do it?
I think that the condition is missing. Please present sample log.

View solution in original post

HiroshiSatoh
Champion
(your search)|bin span=2m _time|dedup _time,field_C

Can you do it?
I think that the condition is missing. Please present sample log.

tegamax
Engager

what does field_C supposed to do??

0 Karma

eolg
New Member

This worked perfectly! Thank you!

0 Karma

adonio
Ultra Champion

@eolg,
if it solved your questin, kindly accept the answer so other will know this solution worked for you

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...