Splunk Search

get the latest value in an array

garumaru
Explorer

Hi Guys,

I am working on searching data from Servicenow ticket, and tickets normally have some status for example:

#Ticket     #Status   #Time

Ticket1       Open        Sep 01

Ticket1       Closed     Sep 02

Ticket2        Open        Sep 01

Ticket2        Pending   Sep 03

 

How can I get a table only list the latest status like below:

#Ticket     #Status   #Time

Ticket1       Closed     Sep 02

Ticket2        Pending   Sep 03

 

Thank you!

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust
| stats latest(Status) as Status latest(_time) as _time by Ticekt
————————————
If this helps, give a like below.

View solution in original post

garumaru
Explorer

Thanks @thambisetty , I was using table but didn't think using stats.

0 Karma

thambisetty
SplunkTrust
SplunkTrust
| stats latest(Status) as Status latest(_time) as _time by Ticekt
————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...