Splunk Search

How can I limt my search results to the first event returned?

ericrobinson
Path Finder

How can I limit my search results to the first event returned?

I am trying to define a transaction that starts with an action that is the first event that I am interested in. The issue is that subsequent updates appear as the same action multiple times in the middle fo the transaction. I am not interested in these subsequent events.

For example:

20100910 09:46:27 FOO ID1

20100910 09:46:28 FOO ID1

20100910 09:46:29 FOO ID1

20100910 09:46:30 FOO ID1

20100910 09:46:28 BAR ID1

20100910 09:46:29 UP ID1

For each unique ID, I want my search to return the first FOO event, the BAR event, and the UP event, and calculate the duration. I want to ignore the additional FOO events.

Tags (1)
0 Karma

southeringtonp
Motivator

Sounds like the dedup command is what you're looking for.

0 Karma

southeringtonp
Motivator

Probably something like sourcetype=xxx | dedup action,id | transaction id

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

seems you should dedup on action, not id.

0 Karma

ericrobinson
Path Finder

That seems to result in only one event being returned as they all have the same ID.. Ill add that the events ate from different sources.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...