Multiple Timestamps - How to filter/select?

[sarge338]

Good day!

I am currently working on a search which provides data from two different event types (connection information and disposition information).  Everything is working well, except both event types have timestamps with the same name.  As a result, my returned data has two timestamps (in the same column) for each record.  

Is there a way to limit the number of timestamps per record to 1?  Or is there a way to somehow designate which event type the timestamp should be pulled from?

Thank you for your help!

[yuanliu]

Thank you for clarifying your question with mock code.

---

Is there a way to limit the number of timestamps per record to 1?  Or is there a way to somehow designate which event type the timestamp should be pulled from?

---

First, are teh two values of timestampStr represent the same time?  If yes, the answer is easy.  Just use the value.

If the two strings are different, only YOU can answer the question correctly.  What is the logic of using one vs the other?  Is one "better" than the other?  If it doesn't matter which, you can use first(timestampStr), last(timestampStr), earliest(timestampStr), latest(timestampStr), or any number of stats functions that yields a single value.

However, if you have a preference, you must describe your preference before any volunteer can help here.

[sarge338]

Hey Giuseppe!  Thanks for the quick response.  Below is my current SPL.

The "guid" field is what ties both event-types together for a single connection.

index="connection_data" 
| stats
values("connections{}.left.facets{}.number") as sourcenumber
values("connections{}.left.facets{}.country") as sourcecountry
values("connections{}.right.facets{}.number") as destinationnumber
values("connections{}.right.facets{}.country") as destinationcountry
values("meta") as direction
values("id") as policyrule
values("disposition.disposition") as disposition
values("resourceId") as router
values("timestampStr") as timestamp
by guid
| eval sourcenumber=mvdedup(sourcenumber)
| eval destinationregion=mvdedup(destinationregion)
| eval destination_rc=mvdedup(destination_rc)
| eval destinationcountry=mvdedup(destinationcountry)
| eval destinationnumber=mvdedup(destinationnumber)
| eval calldisposition=mvdedup(calldisposition)
| where disposition="TERMINATED"

| table timestamp guid sourcenumber sourcecountry destinationnumber destinationcountry direction router disposition

[ITWhisperer]

Most of the eval commands with the mvdedup() functions are superfluous as values() functions in the the prior stats command already dedups the values returned in these fields.

[gcusello]

Hi @sarge338 ,

yes, it's poossible to have one value for each column, but could you share your search?

otherwise it's difficoult to give a correct answer!

in general, you could display only one of the values in the timestamp column ore rename one of the fields, but I need your search to help you.

Ciao.

Giuseppe

[sarge338]

Hey Giuseppe!  Thanks for the quick response.  Below is my current SPL.

The "guid" field is what ties both event-types together for a single connection.

Seems I responded to myself first...

index="connection_data"
| stats
values("connections{}.left.facets{}.number") as sourcenumber
values("connections{}.left.facets{}.country") as sourcecountry
values("connections{}.right.facets{}.number") as destinationnumber
values("connections{}.right.facets{}.country") as destinationcountry
values("meta") as direction
values("id") as policyrule
values("disposition.disposition") as disposition
values("resourceId") as router
values("timestampStr") as timestamp
by guid
| eval sourcenumber=mvdedup(sourcenumber)
| eval destinationregion=mvdedup(destinationregion)
| eval destination_rc=mvdedup(destination_rc)
| eval destinationcountry=mvdedup(destinationcountry)
| eval destinationnumber=mvdedup(destinationnumber)
| eval calldisposition=mvdedup(calldisposition)
| where disposition="TERMINATED"

| table timestamp guid sourcenumber sourcecountry destinationnumber destinationcountry direction router disposition