Splunk Search

How can I limt my search results to the first event returned?

ericrobinson
Path Finder

How can I limit my search results to the first event returned?

I am trying to define a transaction that starts with an action that is the first event that I am interested in. The issue is that subsequent updates appear as the same action multiple times in the middle fo the transaction. I am not interested in these subsequent events.

For example:

20100910 09:46:27 FOO ID1

20100910 09:46:28 FOO ID1

20100910 09:46:29 FOO ID1

20100910 09:46:30 FOO ID1

20100910 09:46:28 BAR ID1

20100910 09:46:29 UP ID1

For each unique ID, I want my search to return the first FOO event, the BAR event, and the UP event, and calculate the duration. I want to ignore the additional FOO events.

Tags (1)
0 Karma

southeringtonp
Motivator

Sounds like the dedup command is what you're looking for.

0 Karma

southeringtonp
Motivator

Probably something like sourcetype=xxx | dedup action,id | transaction id

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

seems you should dedup on action, not id.

0 Karma

ericrobinson
Path Finder

That seems to result in only one event being returned as they all have the same ID.. Ill add that the events ate from different sources.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...