Splunk Search

How can I limt my search results to the first event returned?

Path Finder

How can I limit my search results to the first event returned?

I am trying to define a transaction that starts with an action that is the first event that I am interested in. The issue is that subsequent updates appear as the same action multiple times in the middle fo the transaction. I am not interested in these subsequent events.

For example:

20100910 09:46:27 FOO ID1

20100910 09:46:28 FOO ID1

20100910 09:46:29 FOO ID1

20100910 09:46:30 FOO ID1

20100910 09:46:28 BAR ID1

20100910 09:46:29 UP ID1

For each unique ID, I want my search to return the first FOO event, the BAR event, and the UP event, and calculate the duration. I want to ignore the additional FOO events.

Tags (1)
0 Karma

Motivator

Sounds like the dedup command is what you're looking for.

0 Karma

Motivator

Probably something like sourcetype=xxx | dedup action,id | transaction id

0 Karma

Splunk Employee
Splunk Employee

seems you should dedup on action, not id.

0 Karma

Path Finder

That seems to result in only one event being returned as they all have the same ID.. Ill add that the events ate from different sources.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!