Is there a dedup command to remove events that have same timestamp?

[mlm]

hello guys,

Is there any way that I could remove duplicate events that have same timestamp using this below search string:

index=* (EventCode=4624 OR EventCode=4625)
| stats count(Keywords) as Attempts, count(eval(match(Keywords,"Audit Failure"))) as Failed,
count(eval(match(Keywords,"Audit Success"))) as Success
earliest(_time) as FirstAttempt latest(_time) as LatestAttempt by Account_Name
| where Attempts>=5 AND Success>=1 AND Failed>=2
| eval FirstAttempt=strftime(FirstAttempt,"%x %X")
| eval LatestAttempt=strftime(LatestAttempt,"%x %X")

The output:

Account_Name Attempts Failed Success FirstAttempt LatestAttempt

[ITWhisperer]

index=* (EventCode=4624 OR EventCode=4625)
| dedup _time
| stats count(Keywords) as Attempts, count(eval(match(Keywords,"Audit Failure"))) as Failed,
count(eval(match(Keywords,"Audit Success"))) as Success
earliest(_time) as FirstAttempt latest(_time) as LatestAttempt by Account_Name
| where Attempts>=5 AND Success>=1 AND Failed>=2
| eval FirstAttempt=strftime(FirstAttempt,"%x %X")
| eval LatestAttempt=strftime(LatestAttempt,"%x %X")

[mlm]

hey @ITWhisperer thanks for the reply. unfortunately, it didn't work - it is giving me a "no result found"

[ITWhisperer]

The dedup worked, the issue is that probably the events needed to complete the rest of the query have probably been removed. You will need to be more precise about which events you want to remove.

[mlm]

yeah, so basically, i want to monitor user account's event 4624 & 4625 by attempts, the problem is that there are bunch of duplicate events with same timestamp so i want to remove those and have a unique count

[ITWhisperer]

You could try

| dedup _time EventCode

or

| dedup _time EventCode Account_Name

[mlm]

Awesome!! This one actually works! Thank you so much sir!