Splunk Search

group by from fields

andreyglauzer
New Member

I have events similar to these:

component, technology, mydate
silva, java, 06/20/2019
souza, java, 06/20/2019
silva, java, 07/20/2019
silva, python, 12/07/2019
uol, python, 09/07/2019

I would like to group the events by the technology field, taking all the events that have the largest date. But I can only bring up an event when I try to bring in the latest date using the search:
index = "you" | stats max (mydate) as best by technology

Tags (2)
0 Karma

woodcock
Esteemed Legend

Add this before your stats line:

... | eval mydate = strptime(mydate, "%m/%d/%Y")

Then add this to the end:

... | eval fieldformat mydate = strftime(mydate, "%m/%d/%Y")
0 Karma

HiroshiSatoh
Champion

Try this!

|dedup technology sortby -mydate
0 Karma

andreyglauzer
New Member

Maybe I didn't express myself well. I need to group display all latest events by date by technology. And sometimes I have more than one event with the same date and same technology.

This works better, thanks for the tip.

0 Karma

woodcock
Esteemed Legend

You are still not expressing your needs well. Post sample events, then post a mockup of your desired output. It really is just that simple. You post that and we will post the SPL.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The max function needs a numeric argument, not the strings in the mydate field. Convert the dates into epochs and you should have your results.

index = "you" | eval epoch=strptime(mydate, "%m/%d/%Y") 
| stats max(epoch) as best by technology 
| eval best = strftime(epoch, "%m/%d/%Y")
---
If this reply helps you, Karma would be appreciated.
0 Karma

andreyglauzer
New Member

Maybe I didn't express myself well. I need to group display all latest events by date by technology. And sometimes I have more than one event with the same date and same technology.

Thanks for the max tip.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...