So I'm taking in data from a source that has some duplicate records for the same ID. The only differentiator between events is a "LastModTime" field value, which is an integer. larger number means most recent change.
So I'm trying to write a Splunk search to get all the events from this data source, and where multiple ID exists, only give me the most recent event (i.e. LastModTime is the largest value). Sounded so easy to say, but proving to be a challenge with mvindex command and now I'm stumped.
ID LastModTime Counter
108 1495147243 1
109 1495152331 1
110 1495207972 1
111 1495205705 1
112 1495207542 1
113 1495209093 1 I only want this event out of all the ID=113 events
113 1495217660 1
113 1495218310 1
113 1495222596 1
114 1495211855 1
115 1495212746 1
help?
