How can I limit my search results to the first event returned?
I am trying to define a transaction that starts with an action that is the first event that I am interested in. The issue is that subsequent updates appear as the same action multiple times in the middle fo the transaction. I am not interested in these subsequent events.
For example:
20100910 09:46:27 FOO ID1
20100910 09:46:28 FOO ID1
20100910 09:46:29 FOO ID1
20100910 09:46:30 FOO ID1
20100910 09:46:28 BAR ID1
20100910 09:46:29 UP ID1
For each unique ID, I want my search to return the first FOO event, the BAR event, and the UP event, and calculate the duration. I want to ignore the additional FOO events.
Sounds like the dedup command is what you're looking for.
Probably something like sourcetype=xxx | dedup action,id | transaction id
seems you should dedup on action, not id.
That seems to result in only one event being returned as they all have the same ID.. Ill add that the events ate from different sources.