topic Re: How to use of Group by on the Event Number column to get the latest result by EventTime? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436756#M172583 <P>Just add <CODE>| fields - EventNumber</CODE> to the end of your query.</P> Mon, 11 Mar 2019 13:30:41 GMT FrankVl 2019-03-11T13:30:41Z How to use of Group by on the Event Number column to get the latest result by EventTime? https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436753#M172580 <P>I have a table like below in Splunk<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6677i0FC72ABA47C6075F/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I want to apply a group by on Event Number col and want to get the top(latest) result by EventTime like below</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6678iE74144171ED592EA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span> </P> <P>I am new to Splunk.Can any one suggest me how to achieve it using Splunk search query </P> Mon, 11 Mar 2019 11:59:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436753#M172580 nilanjankc 2019-03-11T11:59:39Z Re: How to use of Group by on the Event Number column to get the latest result by EventTime? https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436754#M172581 <P>Try the following. It parses the EventTime and assigns it to _time, so you can apply stats function latest() to get the latest values by EventNumber.</P> <PRE><CODE>...search that gets you to that data... | eval _time = strptime(EventTime, "%e/%m/%Y %H:%M") | stats latest(EventName) as EventName latest(EventTime) as EventTime by EventNumber </CODE></PRE> Mon, 11 Mar 2019 12:07:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436754#M172581 FrankVl 2019-03-11T12:07:03Z Re: How to use of Group by on the Event Number column to get the latest result by EventTime? https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436755#M172582 <P>Hi Frank </P> <P>Thank you for your quick reply,is there any way that we can hide this EventNumber from displaying as Column but still using it in calculation</P> <P>regards<BR /> Nilanjan </P> Mon, 11 Mar 2019 13:11:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436755#M172582 nilanjankc 2019-03-11T13:11:04Z Re: How to use of Group by on the Event Number column to get the latest result by EventTime? https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436756#M172583 <P>Just add <CODE>| fields - EventNumber</CODE> to the end of your query.</P> Mon, 11 Mar 2019 13:30:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436756#M172583 FrankVl 2019-03-11T13:30:41Z Re: How to use of Group by on the Event Number column to get the latest result by EventTime? https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436757#M172584 <P>Hi Frank <BR /> Your solution works like a charm,just a question, from where I can learn more about Splunk query language. </P> Mon, 11 Mar 2019 13:37:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436757#M172584 nilanjankc 2019-03-11T13:37:28Z Re: How to use of Group by on the Event Number column to get the latest result by EventTime? https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436758#M172585 <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual</A> is a very useful resource.</P> <P>Have you taken the Splunk Fundamentals 1 training, if not, that is also a good starting point. And if you have access to trainings, there are several more advanced trainings on the topic as well.</P> Mon, 11 Mar 2019 13:59:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436758#M172585 FrankVl 2019-03-11T13:59:03Z Re: How to use of Group by on the Event Number column to get the latest result by EventTime? https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436759#M172586 <P>Thank you for your guidance.I started Splunk Fundamentals 1.Happy learning <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Mon, 11 Mar 2019 14:46:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-of-Group-by-on-the-Event-Number-column-to-get-the/m-p/436759#M172586 nilanjankc 2019-03-11T14:46:04Z