Let's say, we have 3 different events ( 2 with Failure messages and 1 with reconfigured message) based on the service name and timestamp.
Event 1 :
2022-07-25 08:29:38.516 service_name=addtocart message=failure
Event 2:
2022-07-25 08:29:35.516 service_name=addtocart message=reconfigured
Event 3:
2022-07-25 08:29:30.516 service_name=addtocart message=failure
Output should be as :
Which service is failed and not reconfigured again based on the latest timestamp
_time | service_name | message |
2022-07-25 08:29:38.516 | addtocart | failure |
The dedup command will return the most recent event with distinct value of a given field. For example,
| dedup service_name
will return the latest message from the addtocart service, which is the desired event from the example.