Splunk Search

How can I limt my search results to the first event returned?

ericrobinson
Path Finder

How can I limit my search results to the first event returned?

I am trying to define a transaction that starts with an action that is the first event that I am interested in. The issue is that subsequent updates appear as the same action multiple times in the middle fo the transaction. I am not interested in these subsequent events.

For example:

20100910 09:46:27 FOO ID1

20100910 09:46:28 FOO ID1

20100910 09:46:29 FOO ID1

20100910 09:46:30 FOO ID1

20100910 09:46:28 BAR ID1

20100910 09:46:29 UP ID1

For each unique ID, I want my search to return the first FOO event, the BAR event, and the UP event, and calculate the duration. I want to ignore the additional FOO events.

Tags (1)
0 Karma

southeringtonp
Motivator

Sounds like the dedup command is what you're looking for.

0 Karma

southeringtonp
Motivator

Probably something like sourcetype=xxx | dedup action,id | transaction id

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

seems you should dedup on action, not id.

0 Karma

ericrobinson
Path Finder

That seems to result in only one event being returned as they all have the same ID.. Ill add that the events ate from different sources.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...