Splunk Search

How would I count by a most recent event value?

splunkingjh
Engager

The value that I need to count can be in multiple events. I just want to count it one time, but it will need to be the most recent value counted.

0 Karma

sundareshr
Legend

Try this, assuming the values are extracted in a field called yourField

index=foo sourcetype=bar | stats dc(yourField) as yourField by facility

*OR*

index=foo sourcetype=bar | timechart span=1h latest(yourField) as yourField by facility

somesoni2
SplunkTrust
SplunkTrust

Without much information, I would suggest to give these a try

index=foo sourcetype=bar yourfield=yourvalue | head 1 | table yourfield

index=foo sourcetype=bar | stats latest(yourfield) as yourfield

splunkingjh
Engager

The second option seems to pull back the most recent. Is there a way that I can count all of those values? I am trying to parse HL7 data. It has presented quite the challenge. I am trying to provide a visual that will show active counts across the facility of different events.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

By "Is there a way that I can count all of those values", Do you mean that you want to count the event which has the same value for field yourfield as in the latest event? If yes, then try something like this (if no, provide more info)

index=foo sourcetype=bar [ search index=foo sourcetype=bar | stats latest(yourfield) as yourfield] | stats count by yourfield
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...