topic Re: Single value from multiple values in Splunk Search

Single value from multiple values

renuka — Thu, 30 Jul 2020 07:47:38 GMT

In my data i am getting multiple dates for single id.i need only recent date for each date.how can i remove other dates.please refer screenshot

Thank you in advance

renuka

Re: Single value from multiple values

bowesmana — Thu, 30 Jul 2020 07:51:21 GMT

I can't see your field names, but I am assuming you are getting your results from a search terminating with something like

| stats values(date) as dates by id

you should use

| stats latest(date) as date by id

but without seeing your search I can't give you a better response

Hope this points you in the right direction

Re: Single value from multiple values

renuka — Thu, 30 Jul 2020 07:57:35 GMT

Thank you for reply,this is my search command and fields

Re: Single value from multiple values

renuka — Thu, 30 Jul 2020 08:16:55 GMT

Thank you so much

Stats latest(date) as date by id is giving the values what i need

Re: Single value from multiple values

bowesmana — Thu, 30 Jul 2020 08:24:56 GMT

You may need to check that the Splunk _time field actually equates to the TC_D2_Execution_Date. If not, then you will need to to it slightly differently, by looking for the largest date, i.e.

| eval t=strptime(TC_D2_Execution_Date, "%a %d %b %Y %H:%M:%S") | stats max(t) as Date by "CRS_Customer Requirement Identifier" | eval Date=strftime(Date, "%a %d %b %Y %H:%M:%S")