Refine your search:

I am using dedup in my search and my time criteria is real time. The events are coming every minute but the results are not changing at top of the minute. I have turned on default_backfill option to fill the result very first time with the historical data. The data is getting refreshed when the current results fall out of time window i.e. after 5 minutes. And it shows again the oldest data in the window. Because of that data refresh every minute then on as the last result falls out of window.


index="summary" source="transaction_rate" | dedup site

I am seeing the latest result if I don't use the dedup command.

asked 09 Nov '11, 08:03

asingla's gravatar image

asingla
171115
accept rate: 28%

edited 09 Nov '11, 08:03


One Answer:

If I sort the result first and then dedup that works. Got the idea from here.

index="summary" source="transaction_rate" | sort -_time | dedup site

Looks like if you have stats command then also data does not get refreshed as the event come until the present result falls out of window. Anybody can explain why such behavior?

link

answered 09 Nov '11, 08:18

asingla's gravatar image

asingla
171115
accept rate: 28%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×88
×42

Asked: 09 Nov '11, 08:03

Seen: 1,238 times

Last updated: 09 Nov '11, 08:18

Copyright © 2005-2012 Splunk Inc. All rights reserved.