Splunk Search

I want to include field values which have the latest timestamp value for a particular field

bineetadas
New Member

events are like this : number = INCXXXXXX dv_sys = yyyy-mm-dd hh:mm:ss group = lx ........
for a particular value of field number there are multiple events containing various values for the other field dv
_sys

I only want my search results to display the one with the latest timestamp value.

Can anyone help with the correct syntax please?

Tags (1)
0 Karma
1 Solution

aberkow
Builder

To use the latest function of the stats command, you need a _time field. So, for each log, you probably want to create that field with an eval statement, leveraging the strptime command

base search to pull logs in...
| eval _time=strptime(dv_sys, "%Y-%m-%d H:M:S")
| stats latest(number) as latestNumber by _time

You'll likely need to play with the dv_sys strptime extract using the common variables found here: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Commontimeformatvariables, but this should generally get you what you're going for. If you already have a _time field on each log, then you can just ignore the eval command and go straight to the stats.

Does this answer your question?

View solution in original post

0 Karma

aberkow
Builder

To use the latest function of the stats command, you need a _time field. So, for each log, you probably want to create that field with an eval statement, leveraging the strptime command

base search to pull logs in...
| eval _time=strptime(dv_sys, "%Y-%m-%d H:M:S")
| stats latest(number) as latestNumber by _time

You'll likely need to play with the dv_sys strptime extract using the common variables found here: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Commontimeformatvariables, but this should generally get you what you're going for. If you already have a _time field on each log, then you can just ignore the eval command and go straight to the stats.

Does this answer your question?

0 Karma

arjunpkishore5
Motivator

i would guess number is your id field. In your example, it looks like it's a bmc incident number.

you can do this |stats latest(*) as * by < id fields >

in your case, |stats latest(*) as * by number

This works only if the _time values are different. I would suggest using a filed like "Last Modified timestamp" for _time

Please mark as answer if this answers your query

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...