Which value does the dedup command keep?

[Simeon]

I am running the dedup command for my ip_address field and I want to know the value returned by the command. Is it the last value seen, first value seen, something random? My search looks like this;

sourcetype=firewall_log | dedup ip_address

[Simeon · Accepted solution]

The dedup command will return the first key value found for that particular field. This means the most recent in time, as splunk searches from latest to earliest. For example, in the search that dedups the ip_address value for your firewall log, you will see the most recent ip_address that has been logged to that source.

For more detail: http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup