https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-latest-time-project-name-in-each-group/m-p/433741#M167058 <P>no,no,no ,the result of this way is <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5952iEFF5C0D31C6FEFC3/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I need latest time project name in each group. and there is only one data in each group</P> Sun, 14 Oct 2018 02:57:01 GMT flzhang132 2018-10-14T02:57:01Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-latest-time-project-name-in-each-group/m-p/433739#M167056 <P>I want to group by virtual machine and then find the latest time project name in each group. How would I implement this? </P> <P>thanks!</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5953i543D01C3899776B8/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sat, 13 Oct 2018 07:48:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-latest-time-project-name-in-each-group/m-p/433739#M167056 flzhang132 2018-10-13T07:48:18Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-latest-time-project-name-in-each-group/m-p/433740#M167057 <P>try this:</P> <PRE><CODE>|stats latest(time) by vm_id project </CODE></PRE> Sat, 13 Oct 2018 08:13:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-latest-time-project-name-in-each-group/m-p/433740#M167057 493669 2018-10-13T08:13:33Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-latest-time-project-name-in-each-group/m-p/433741#M167058 <P>no,no,no ,the result of this way is <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5952iEFF5C0D31C6FEFC3/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I need latest time project name in each group. and there is only one data in each group</P> Sun, 14 Oct 2018 02:57:01 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-latest-time-project-name-in-each-group/m-p/433741#M167058 flzhang132 2018-10-14T02:57:01Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-latest-time-project-name-in-each-group/m-p/433742#M167059 <P>@flzhang132</P> <P>Have you tried this?</P> <PRE><CODE>YOUR_SEARCH | stats latest(project) as project latest(_time) as _time by vm_id </CODE></PRE> <P><STRONG>Sample Search:</STRONG></P> <PRE><CODE>| makeresults | eval project="erp",vm_id=100,_time=now()-180 | append [| makeresults | eval project="erp",vm_id=100,_time=now()-120] | append [| makeresults | eval project="ems",vm_id=100,_time=now()-60] | append [| makeresults | eval project="mcs",vm_id=101,_time=now()-180] | append [| makeresults | eval project="mcs",vm_id=101,_time=now()-120] | append [| makeresults | eval project="mes",vm_id=101,_time=now()-60] | stats latest(project) as project latest(_time) as _time by vm_id </CODE></PRE> <P>Thanks</P> Sun, 14 Oct 2018 04:23:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-the-latest-time-project-name-in-each-group/m-p/433742#M167059 kamlesh_vaghela 2018-10-14T04:23:52Z