How to keep the original start time, but continuously update the end time using the dedup command?

[rebeccaweaver]

So the query that is currently in use is:

index=name source=source_name | fields start_time end_time src subject category id body| dedup id | table start_time end_time src subject category id body

Where the table shows all events correlated with the same id, however, it keeps the original start_time and end_time of the first event with that id. I want to keep the original start time, but continuously update the end time.

On a side note, when enabling drill down per cell is there a way to have the drill down to the search field only search on the index/source/field selected? Currently, when clicking on a random field it searches on the index/source/start_time/selected field.

[somesoni2]

You can use following query to get the original (first) start_time and latest end_time when you run the query.

index=name source=source_name | fields start_time end_time src subject category id body| stats earliest(start_time) as start_time latest(*) as * by id | table start_time end_time src subject category id body

For the conditional drilldown, you can use methods from following documentation page to enable drilldown on certain fields only.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens#Define_tokens_for_conditional_oper... (see the example where it enables drilldown only for field sourcetype)

[adonio]

try this:

index=name source=source_name 
| fields start_time end_time src subject category id body
| dedup id 
| stats earliest(start_time) as start latest(end_time) as end by src subject category id body

[rebeccaweaver]

That did not work, all it did was change the names of the columns, and move the start and end to the far right, rather than the left. It still had the incorrect values.