Splunk Search

Why is dedup not giving me the earliest event?

New Member

I'm attempting to consolidate records that share the same values in 3 fields, and I want to keep the event that has the earliest time.
I keep getting the same record (newest) even though I am sorting them by time:

dedup 1 licUser licType licPC sortby -_time

Any ideas?

Tags (3)
0 Karma

Motivator

try like:

...|dedup  _time |sort -_time|table  licUser  licType  licPC  _time

or

...|sort -_time|stats first(licUser) first(licType) first(licPC) by _time|
0 Karma

Communicator

Dedup keeps the first event seen. Since searches are performed from most recent to oldest, it will keep the newest event regardless of what other things you attempt in the search string.

I'd recommend that you try | stats earliest(field)
See more here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonStatsFunctions

0 Karma

New Member

But this doesn't leave me with the fields I need to continue such as _time.

0 Karma

Builder

dedup command removes the subsequent duplicate results that match specified criteria. it's not means that it'll return the last event, but it return the first event that macth with creiterias. this event can be the first, the last ...

if you want the last, you can use last function to do that.

... |last(licUser) last(licType) last(licPC) by -_time|...
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!