How can I limt my search results to the first event returned?

[ericrobinson]

How can I limit my search results to the first event returned?

I am trying to define a transaction that starts with an action that is the first event that I am interested in. The issue is that subsequent updates appear as the same action multiple times in the middle fo the transaction. I am not interested in these subsequent events.

For example:

20100910 09:46:27 FOO ID1

20100910 09:46:28 FOO ID1

20100910 09:46:29 FOO ID1

20100910 09:46:30 FOO ID1

20100910 09:46:28 BAR ID1

20100910 09:46:29 UP ID1

For each unique ID, I want my search to return the first FOO event, the BAR event, and the UP event, and calculate the duration. I want to ignore the additional FOO events.

[southeringtonp]

Sounds like the dedup command is what you're looking for.

[ericrobinson]

That seems to result in only one event being returned as they all have the same ID.. Ill add that the events ate from different sources.

[gkanapathy]

seems you should dedup on action, not id.

[southeringtonp]

Probably something like sourcetype=xxx | dedup action,id | transaction id