hi team,
i am using below splunk search in dashboards query
index=BigIt log_severity=INFO or WARN app_name= test-cap-generator country_code=USA error_code= COA-1004 earliest=-5d rex " total number where indicator I is Z(?<Counts>\d)" | stats count by _time, Counts | table _time,Counts
Requirement : i have to filter runs which are occuring once.. daily and ignore the duplicate runs which are showing up in splunk query any suggestion please how can i ignore those duplicate runs
anything which ran after 07:00 am should be ignored for that particular day
for example in below image for date 2023-02-02 i have to filter only 06:28 run
| eval time=strftime(_time,"%H%M")
| where time < 700