Splunk Search

How do you get a table of most recent events with multiple fields?

rsrcno
New Member

I have events that are performance metrics taken over time. It includes fields like the sample value and object it pertains to. I want to display a table with that object and the most recent sample value for each object. Right now a query that shows all values would look something like this:

index=custom | table _time, account, metric_name, metric_value

I would like to do a query like

index=custom metric_name=utilization | blah blah

and get a table that includes account, metric_name, metric_value, time, but only show the most recent value for each account/metric_name.

Tags (2)
0 Karma

Vijeta
Influencer

you can do this

index=custom| stats latest(_time) as _time,  latest(metric_value) as metric_value by account metric_name
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...