topic Re: group by from fields in Splunk Search

group by from fields

andreyglauzer — Sat, 27 Jul 2019 17:42:31 GMT

I have events similar to these:

component, technology, mydate
silva, java, 06/20/2019
souza, java, 06/20/2019
silva, java, 07/20/2019
silva, python, 12/07/2019
uol, python, 09/07/2019

I would like to group the events by the technology field, taking all the events that have the largest date. But I can only bring up an event when I try to bring in the latest date using the search:
index = "you" | stats max (mydate) as best by technology

Re: group by from fields

richgalloway — Sun, 28 Jul 2019 02:59:13 GMT

The max function needs a numeric argument, not the strings in the mydate field. Convert the dates into epochs and you should have your results.

index = "you" | eval epoch=strptime(mydate, "%m/%d/%Y") 
| stats max(epoch) as best by technology 
| eval best = strftime(epoch, "%m/%d/%Y")

Re: group by from fields

HiroshiSatoh — Sun, 28 Jul 2019 03:09:49 GMT

Try this!

|dedup technology sortby -mydate

Re: group by from fields

woodcock — Sun, 28 Jul 2019 12:31:09 GMT

Add this before your stats line:

... | eval mydate = strptime(mydate, "%m/%d/%Y")

Then add this to the end:

... | eval fieldformat mydate = strftime(mydate, "%m/%d/%Y")

Re: group by from fields

andreyglauzer — Sun, 28 Jul 2019 13:18:56 GMT

Maybe I didn't express myself well. I need to group display all latest events by date by technology. And sometimes I have more than one event with the same date and same technology.

Thanks for the max tip.

Re: group by from fields

andreyglauzer — Sun, 28 Jul 2019 13:20:16 GMT

Maybe I didn't express myself well. I need to group display all latest events by date by technology. And sometimes I have more than one event with the same date and same technology.

This works better, thanks for the tip.

Re: group by from fields

woodcock — Sun, 28 Jul 2019 13:33:04 GMT

You are still not expressing your needs well. Post sample events, then post a mockup of your desired output. It really is just that simple. You post that and we will post the SPL.