Is there a way to deduplicate data by date?

[brcrommett]

I'm trying to run a quarterly report that lists unique individuals in a building. The search lists each building name, individual, apartment, service address, and a number for that individual, then groups by organization and corporation and sums that number by the organization. The data lists these individuals multiple times so I'm using 'dedup Name' to narrow the results, as I want 1 number per individual. That works fine for a single month but I need to display this list for each month in the quarter on the same report.

Is there a way to deduplicate the name by date? perhaps a foreach statement?

current statement

index = csv | table "building name",Name,Apartment,Number,"Service Address",Org,Date,Corp | dedup Name | stats list("Building Name") list(Name) list(Apartment) list("Service Address") list(Number) sum(Number) by Corp,Org,Date

[JDukeSplunk · Accepted solution]

Maybe ?

index = csv 
|bucket _time span=1d
| table "building name",Name,Apartment,Number,"Service Address",Org,Date,Corp
| dedup Name , Date
| stats list("Building Name") list(Name) list(Apartment) list("Service Address") list(Number) sum(Number) by Corp,Org,Date

[brcrommett]

That's perfect. Thanks!