Splunk Search

How to keep the original start time, but continuously update the end time using the dedup command?

rebeccaweaver
New Member

So the query that is currently in use is:

index=name source=source_name | fields start_time end_time src subject category id body| dedup id | table start_time end_time src subject category id body

Where the table shows all events correlated with the same id, however, it keeps the original start_time and end_time of the first event with that id. I want to keep the original start time, but continuously update the end time.

On a side note, when enabling drill down per cell is there a way to have the drill down to the search field only search on the index/source/field selected? Currently, when clicking on a random field it searches on the index/source/start_time/selected field.

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can use following query to get the original (first) start_time and latest end_time when you run the query.

index=name source=source_name | fields start_time end_time src subject category id body| stats earliest(start_time) as start_time latest(*) as * by id | table start_time end_time src subject category id body

For the conditional drilldown, you can use methods from following documentation page to enable drilldown on certain fields only.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens#Define_tokens_for_conditional_oper... (see the example where it enables drilldown only for field sourcetype)

0 Karma

adonio
Ultra Champion

try this:

index=name source=source_name 
| fields start_time end_time src subject category id body
| dedup id 
| stats earliest(start_time) as start latest(end_time) as end by src subject category id body
0 Karma

rebeccaweaver
New Member

That did not work, all it did was change the names of the columns, and move the start and end to the far right, rather than the left. It still had the incorrect values.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...