https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475634#M192589 <P>The best way would be to append to this result. But a seperate search would be fine too.</P> Thu, 07 Nov 2019 07:57:09 GMT wvanloon 2019-11-07T07:57:09Z https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475628#M192583 <P>My data looks like this:</P> <P>_time:11/5/1912:41:00 <BR /> ID: 123 <BR /> Value:10</P> <P>For each minute I want to know the last value that was known in that minute. How can I achieve this?<BR /> The ID is not updated every minute, so if the latest value for a given id at the moment 12:41 is 10 I want the same number for 12:42.</P> <P>I've tried something like this:<BR /> index="" | bin span=1m _time | streamstats current=f window=1440 last(value) AS last_value by id </P> <P>But I have the feeling I am missing a part.</P> <P>Thanks in advance.</P> Wed, 30 Sep 2020 02:49:27 GMT https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475628#M192583 wvanloon 2020-09-30T02:49:27Z https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475629#M192584 <P>Does adding _time at the end of your <CODE>by id</CODE> clause help?</P> <P><CODE>by id _time</CODE></P> Tue, 05 Nov 2019 17:30:21 GMT https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475629#M192584 marycordova 2019-11-05T17:30:21Z https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475630#M192585 <P>No that is not working. The problem is that if you group by id and _time it will not find the latest value before that time if the value for that minute doesn't exist.</P> Wed, 06 Nov 2019 08:40:48 GMT https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475630#M192585 wvanloon 2019-11-06T08:40:48Z https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475631#M192586 <P>I think what you're looking for is this.</P> <PRE><CODE>index = someindex | fields _time, value, id | timechart span=1m latest(value) as value by id limit=0 | filldown </CODE></PRE> <P>If this id has never had a value in the selected time range, then it won't show up.</P> Wed, 06 Nov 2019 12:07:54 GMT https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475631#M192586 arjunpkishore5 2019-11-06T12:07:54Z https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475632#M192587 <P>Thanks this is the beginning for what I was looking for.</P> <P>After this search I want to be able to count the occurrence of each value by time, any idea?</P> Wed, 06 Nov 2019 13:37:01 GMT https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475632#M192587 wvanloon 2019-11-06T13:37:01Z https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475633#M192588 <P>You're welcome.</P> <P>The occurrence, is this going to be a separate search? or you want to append to the results of this search?</P> Thu, 07 Nov 2019 01:24:47 GMT https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475633#M192588 arjunpkishore5 2019-11-07T01:24:47Z https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475634#M192589 <P>The best way would be to append to this result. But a seperate search would be fine too.</P> Thu, 07 Nov 2019 07:57:09 GMT https://community.splunk.com/t5/Splunk-Search/Use-aggregate-function-latest-for-each-minute-to-use-timechart/m-p/475634#M192589 wvanloon 2019-11-07T07:57:09Z