Knowledge Management

Summary Index has Duplicates

aohls
Contributor

I have a search I created that runs for the last 5 minutes. I scheduled this to run every 5 minutes to update a summary index I have. I am finding duplicates on my data. Is there a better way to manage the run times to make sure there are no duplicates? I am only putting a table into the summary, there are no stat commands. Is there some way to handle this better?

0 Karma
1 Solution

aohls
Contributor

I had created a field extraction not realizing that happened automatically; this caused duplicate results.

View solution in original post

0 Karma

aohls
Contributor

I had created a field extraction not realizing that happened automatically; this caused duplicate results.

0 Karma

gcusello
Esteemed Legend

Hi aohls,
are your duplicates only in the last seconds of the five minutes or in all the period?
if duplicates are only in the last period, you could insert in your main search a subsearch from the summary index excluding events alreadi indexed, in other words something like this:

index=my_index NOT [ search my_symmaty_index | fields _time field1 field2 field3 ]
| table _time field1 field2 field3 
| collect index=my_summary_index

If instead are in a larger period, you should analyze again you data and your search.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...