Splunk Search

Using dedup in multi-month query

wu_weidong
Path Finder

I'm trying to create a timechart showing the count of events over 6 months. The query is

index=itemdb `macrotest` (name != "*itemA" AND name != "*itemB") | eval category = case(...) | eval fields = split(name,"_") | eval mname = mvindex(fields,1) | search category = "promo" | dedup f_1 f_2 | timechart count by id span=1mon

The goal is to dedup within that month only, not across all 6 months. For example, if the same values of f_1,f_2 appear in all 6 months, I should get 1 count of f_1,f_2 in each of the 6 months, not only in the last month. However, it seems like the f_1,f_2 values will be dedup across all 6 months, and appear only in the last month.

Can I bin events by the months they appear in, then dedup within that month only to achieve this? Or is there another way?

0 Karma

to4kawa
Ultra Champion
index=itemdb `macrotest` (name != "*itemA" AND name != "*itemB") 
| eval category = case(...) 
| eval fields = split(name,"_") 
| eval mname = mvindex(fields,1) 
| search category = "promo" 
| eval f_1_tmp=f_1.":".strftime(_time,"%Y%m"),f_2_tmp=f_2.":".strftime(_time,"%Y%m")
| dedup f_1_tmp f_2_tmp 
| timechart count by id span=1mon
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...