dedup only 1 hr possible ?

[sbnoobbb]

I have a query that has a interval of few mins there are some duplicated results during that hour. When I use dedup it delete all the previous result and display the latest. Anyone met this problem? How can I only dedup results for every hour ?

[sbnoobbb · Accepted solution]

Solve by | transaction locationaccident maxspan=5m | bucket span=1h _time | dedup _time | chart ... by _time

[linu1988]

Refer this http://splunk-base.splunk.com/answers/24470/buckettimechart-and-dedup

[sbnoobbb]

Thanks will look at it!

[linu1988]

Use transaction to group the results per hour, then apply the dedup. Thanks