Splunk Search

How can I limt my search results to the first event returned?

ericrobinson
Path Finder

How can I limit my search results to the first event returned?

I am trying to define a transaction that starts with an action that is the first event that I am interested in. The issue is that subsequent updates appear as the same action multiple times in the middle fo the transaction. I am not interested in these subsequent events.

For example:

20100910 09:46:27 FOO ID1

20100910 09:46:28 FOO ID1

20100910 09:46:29 FOO ID1

20100910 09:46:30 FOO ID1

20100910 09:46:28 BAR ID1

20100910 09:46:29 UP ID1

For each unique ID, I want my search to return the first FOO event, the BAR event, and the UP event, and calculate the duration. I want to ignore the additional FOO events.

Tags (1)
0 Karma

southeringtonp
Motivator

Sounds like the dedup command is what you're looking for.

0 Karma

southeringtonp
Motivator

Probably something like sourcetype=xxx | dedup action,id | transaction id

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

seems you should dedup on action, not id.

0 Karma

ericrobinson
Path Finder

That seems to result in only one event being returned as they all have the same ID.. Ill add that the events ate from different sources.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...