Why is dedup not giving me the earliest event?

[cmamer]

I'm attempting to consolidate records that share the same values in 3 fields, and I want to keep the event that has the earliest time.
I keep getting the same record (newest) even though I am sorting them by time:

dedup 1 licUser licType licPC sortby -_time

Any ideas?

[fdi01]

try like:

...|dedup  _time |sort -_time|table  licUser  licType  licPC  _time

or

...|sort -_time|stats first(licUser) first(licType) first(licPC) by _time|

[kearaspoor]

Dedup keeps the first event seen. Since searches are performed from most recent to oldest, it will keep the newest event regardless of what other things you attempt in the search string.

I'd recommend that you try | stats earliest(field)
See more here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonStatsFunctions

[cmamer]

But this doesn't leave me with the fields I need to continue such as _time.

[NOUMSSI]

dedup command removes the subsequent duplicate results that match specified criteria. it's not means that it'll return the last event, but it return the first event that macth with creiterias. this event can be the first, the last ...

if you want the last, you can use last function to do that.

... |last(licUser) last(licType) last(licPC) by -_time|...