Splunk Search

dedup in real time window is not working

asingla
Communicator

I am using dedup in my search and my time criteria is real time. The events are coming every minute but the results are not changing at top of the minute. I have turned on default_backfill option to fill the result very first time with the historical data. The data is getting refreshed when the current results fall out of time window i.e. after 5 minutes. And it shows again the oldest data in the window. Because of that data refresh every minute then on as the last result falls out of window.


index="summary" source="transaction_rate" | dedup site

I am seeing the latest result if I don't use the dedup command.

Tags (2)
0 Karma

asingla
Communicator

If I sort the result first and then dedup that works. Got the idea from here.

index="summary" source="transaction_rate" | sort -_time | dedup site

Looks like if you have stats command then also data does not get refreshed as the event come until the present result falls out of window. Anybody can explain why such behavior?

0 Karma
Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...