https://community.splunk.com/t5/Getting-Data-In/How-do-you-get-the-latest-time-entry-from-a-datetime-field-value/m-p/383574#M69067 <P>adding limit=1 will limit your results to 1 date and useother=0 will stop it from grouping everything else into an 'other' category. </P> <PRE><CODE>index="ad_dns_new" sourcetype="resolve_json" | eval k=strptime(DateTime,"%Y-%m-%dT%H:%M:%S") | eval New_Date=strftime(k,"%d-%m-%Y %H:%M:%S") | table HealthCheck,Result,New_Date,Customer | sort - New_Date | chart values(Result) as Result over HealthCheck by New_Date limit=1 useother=0 </CODE></PRE> Tue, 13 Nov 2018 17:53:39 GMT kmaron 2018-11-13T17:53:39Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-get-the-latest-time-entry-from-a-datetime-field-value/m-p/383573#M69066 <P>I have one field value as a datetime field, and I want the data of only the latest time. How can I write this query? <BR /> My current search is:</P> <PRE><CODE>index="ad_dns_new" sourcetype="resolve_json"|eval k=strptime(DateTime,"%Y-%m-%dT%H:%M:%S")|eval New_Date=strftime(k,"%d-%m-%Y %H:%M:%S") | table HealthCheck,Result,New_Date,Customer|chart values(Result) as Result over HealthCheck by New_Date </CODE></PRE> <P>I am attaching an image of my current output. From that, I want data of 11th nov 15:36:57. </P> <P>How can I do that? </P> <P>I look forward to hearing from you.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6076iB296EFAE1391A3B2/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 13 Nov 2018 10:59:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-get-the-latest-time-entry-from-a-datetime-field-value/m-p/383573#M69066 darshana2511 2018-11-13T10:59:33Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-get-the-latest-time-entry-from-a-datetime-field-value/m-p/383574#M69067 <P>adding limit=1 will limit your results to 1 date and useother=0 will stop it from grouping everything else into an 'other' category. </P> <PRE><CODE>index="ad_dns_new" sourcetype="resolve_json" | eval k=strptime(DateTime,"%Y-%m-%dT%H:%M:%S") | eval New_Date=strftime(k,"%d-%m-%Y %H:%M:%S") | table HealthCheck,Result,New_Date,Customer | sort - New_Date | chart values(Result) as Result over HealthCheck by New_Date limit=1 useother=0 </CODE></PRE> Tue, 13 Nov 2018 17:53:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-get-the-latest-time-entry-from-a-datetime-field-value/m-p/383574#M69067 kmaron 2018-11-13T17:53:39Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-get-the-latest-time-entry-from-a-datetime-field-value/m-p/383575#M69068 <P>limit does not work with my query. as I have multiple date values as column names</P> Wed, 14 Nov 2018 14:51:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-get-the-latest-time-entry-from-a-datetime-field-value/m-p/383575#M69068 darshana2511 2018-11-14T14:51:47Z