https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-record-of-each-month-for-each-specific/m-p/360334#M106515 <P>You can try the following:</P> <PRE><CODE>index="snow" sourcetype="snow:incident" number="*" state_values="*" | dedup number state_values | search state_values!="Resolved" | timechart span="1mon" count(number) as Count by assignment_group_name </CODE></PRE> <P>Same should also be achievable by stats followed by timechart.</P> <P>PS: If _time does not match with sys_updated_on then you might need to add <CODE>| eval _time=sys_updated_on</CODE> before timechart or else use chart <STRONG>over sys_updated_on</STRONG> instead of timechart</P> <PRE><CODE>| chart span="1mon" count(number) as Count over sys_updated_on by assignment_group_name </CODE></PRE> Tue, 29 Sep 2020 13:55:30 GMT niketn 2020-09-29T13:55:30Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-record-of-each-month-for-each-specific/m-p/360333#M106514 <P>Dear guys,<BR /> I'm very new in Splunk and I got some work task which still have no idea about the solution. Please kindly give some suggestion. </P> <P>The purpose of this search is <STRONG>"To track the number of backlog case in each month divided by assignment_group_name"</STRONG></P> <P>The number will be count in each assignment_group_name only if the last record of each month was assigned to that assignment group and the state_values of that record must not be "Resolved" <BR /> In case, there are no record of the current month, program will get the the last record of the last month instead.</P> <P>Here is the example of raw data,</P> <P><EM>index="snow" sourcetype="snow:incident" number="INC0079884" OR number="INC0086062"<BR /> | table number sys_updated_on sys_created_on assignment_group_name state_values<BR /> |sort number sys_updated_on</EM><BR /> <IMG src="https://community.splunk.com/storage/temp/194302-capture.png" alt="alt text" /></P> <P>The result should be look like this</P> <P><IMG src="https://community.splunk.com/storage/temp/194305-backlog.png" alt="alt text" /></P> Tue, 29 Sep 2020 13:55:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-record-of-each-month-for-each-specific/m-p/360333#M106514 urapaveerapan 2020-09-29T13:55:16Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-record-of-each-month-for-each-specific/m-p/360334#M106515 <P>You can try the following:</P> <PRE><CODE>index="snow" sourcetype="snow:incident" number="*" state_values="*" | dedup number state_values | search state_values!="Resolved" | timechart span="1mon" count(number) as Count by assignment_group_name </CODE></PRE> <P>Same should also be achievable by stats followed by timechart.</P> <P>PS: If _time does not match with sys_updated_on then you might need to add <CODE>| eval _time=sys_updated_on</CODE> before timechart or else use chart <STRONG>over sys_updated_on</STRONG> instead of timechart</P> <PRE><CODE>| chart span="1mon" count(number) as Count over sys_updated_on by assignment_group_name </CODE></PRE> Tue, 29 Sep 2020 13:55:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-record-of-each-month-for-each-specific/m-p/360334#M106515 niketn 2020-09-29T13:55:30Z