×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
oajengui
Explorer
Member since: ‎02-26-2019
‎11-19-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 4
Karma Received 1
Member Since ‎02-26-2019
Activity Feed
View All

Re: how to remove duplicate event when I am using ...

by in Knowledge Management
‎01-09-2020 05:51 AM
‎01-09-2020 05:51 AM
I'm facing the same situation where i found duplicates in my datamodel, because the dataset I created for the model is root event based and I have duplicates in my indexed events , and I couldn't find any command to de-duplicate the data from the model, so a workaround for that is to create a dataset for the data model based on root search instead of root event, and in that search add a dedup command, that way the data in the data model should not have duplicates, but it would be easier if there was a command that be used after creating the data model to deduplicate the data, because in my case i had to recreate the dataset of my datamodel ... View more

How to generate smaller time frame events from a g...

by in Splunk Search
‎02-26-2019 07:33 AM
‎02-26-2019 07:33 AM
Hi everyone, I have this current situation, I receive events that each one contain a start time and end time, the duration between start and end can be seconds, minutes or hours it depends on how long the event took time, and I would like like to split or break down each event to have multiple events for the same Initial Event ID but with 1 minute/or second duration, and I was wondering if this can be done on splunk. Here is an example: EventID= xxxxxxxxxxxxx StartTime=2019-02-02 15:23:12:393 UTC EndTime=2019-02-02 15:30:20:393 UTC So the duration is around 8 minutes and I would like to have this event, 8 rows(or sub-events) for each minute of this 8 minutes duration like this : EventID= xxxxxxxxxxxxx StartTime=2019-02-02 15:23:12:393 UTC EndTime=2019-02-02 15:24:12:393 UTC EventID= xxxxxxxxxxxxx StartTime=2019-02-02 15:23:12:393 UTC EndTime=2019-02-02 15:25:12:393 UTC EventID= xxxxxxxxxxxxx StartTime=2019-02-02 15:23:12:393 UTC EndTime=2019-02-02 15:26:12:393 UTC EventID= xxxxxxxxxxxxx StartTime=2019-02-02 15:23:12:393 UTC EndTime=2019-02-02 15:27:12:393 UTC EventID= xxxxxxxxxxxxx StartTime=2019-02-02 15:23:12:393 UTC EndTime=2019-02-02 15:28:12:393 UTC EventID= xxxxxxxxxxxxx StartTime=2019-02-02 15:23:12:393 UTC EndTime=2019-02-02 15:29:12:393 UTC EventID= xxxxxxxxxxxxx StartTime=2019-02-02 15:23:12:393 UTC EndTime=2019-02-02 15:30:12:393 UTC ... Is it possible to do so in splunk? Thanks in advance 🙂 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎11-19-2020 12:29 PM
Karma given to
View All