Splunk Search

dedup only 1 hr possible ?

sbnoobbb
Path Finder

I have a query that has a interval of few mins there are some duplicated results during that hour. When I use dedup it delete all the previous result and display the latest. Anyone met this problem? How can I only dedup results for every hour ?

Tags (1)
0 Karma
1 Solution

sbnoobbb
Path Finder

Solve by | transaction locationaccident maxspan=5m | bucket span=1h _time | dedup _time | chart ... by _time

View solution in original post

0 Karma

sbnoobbb
Path Finder

Solve by | transaction locationaccident maxspan=5m | bucket span=1h _time | dedup _time | chart ... by _time

0 Karma

sbnoobbb
Path Finder

Thanks will look at it!

0 Karma

linu1988
Champion

Use transaction to group the results per hour, then apply the dedup. Thanks

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...