I have events similar to these:
component, technology, mydate
silva, java, 06/20/2019
souza, java, 06/20/2019
silva, java, 07/20/2019
silva, python, 12/07/2019
uol, python, 09/07/2019
I would like to group the events by the technology field, taking all the events that have the largest date. But I can only bring up an event when I try to bring in the latest date using the search:
index = "you" | stats max (mydate) as best by technology
Add this before your stats
line:
... | eval mydate = strptime(mydate, "%m/%d/%Y")
Then add this to the end:
... | eval fieldformat mydate = strftime(mydate, "%m/%d/%Y")
Try this!
|dedup technology sortby -mydate
Maybe I didn't express myself well. I need to group display all latest events by date by technology. And sometimes I have more than one event with the same date and same technology.
This works better, thanks for the tip.
You are still not expressing your needs well. Post sample events, then post a mockup of your desired output. It really is just that simple. You post that and we will post the SPL.
The max
function needs a numeric argument, not the strings in the mydate field. Convert the dates into epochs and you should have your results.
index = "you" | eval epoch=strptime(mydate, "%m/%d/%Y")
| stats max(epoch) as best by technology
| eval best = strftime(epoch, "%m/%d/%Y")
Maybe I didn't express myself well. I need to group display all latest events by date by technology. And sometimes I have more than one event with the same date and same technology.
Thanks for the max tip.