I have 2 sources of events with "almost" the same framework and some of them reference the same event with the same content. I want to hide in my search the events which matchs between the both sources for seeing only the single events. I don't know what kind of function i have to use to do that (dedup, correlate ????)
Here is a single event from the 2 differents sources
Event in source 1
Event in source 2
I know i can use the date, hours, minutes and type of event to check if there's a duplicate, doing a dedup of the 2 events and hide it.
How could i do that ?
asked 06 Jan '12, 07:02
EDIT: Sorry, I see now that I misunderstood your question, I didn't realize you wanted to remove BOTH events. For that I would advise you to use
This will remove all transactions which have more than one event (i.e. the ones with duplicate messages).
Dedup is still going to return one of the events though. If you want to return only those events that are not in both sets, you could:
Perform a search taht returns both event types in the same result set. Add a field to each event that identifies what "type" or source each event comes from. Maybe
answered 06 Jan '12, 12:58