topic Re: if multiple events at different time, only return most recent events based on a field in Splunk Search

if multiple events at different time, only return most recent events based on a field

salt87 — Sat, 09 Nov 2019 20:26:39 GMT

Hi,

I've got a search that returns me the following results:

Basically, I would like to only keep the most recent events for an IPAddress IF the field IPAddress has multiple events at 2 different time and discard the oldest event. In the case of the screenshot above, I would like to remove the highlighted line.

Would that be possible? Let me know if you need more information.

Thanks

Re: if multiple events at different time, only return most recent events based on a field

arjunpkishore5 — Sat, 09 Nov 2019 21:24:14 GMT

Base on the example you provided

| stats values(pluginID) as pluginID by _time, IPAddress delim=","
| slats latest(pluginID) as pluginID, max(_time) as _time by IPAddress
| eval pluginID=split(pluginID,",")
| mvexpand pluginID

Re: if multiple events at different time, only return most recent events based on a field

woodcock — Sat, 09 Nov 2019 23:16:51 GMT

Just add this to the bottom:

... | dedup IPAddress

Re: if multiple events at different time, only return most recent events based on a field

salt87 — Sun, 10 Nov 2019 20:50:33 GMT

Hi,

This won't work because I still need to see all events for an IPAddress. This will only show me one event per IP.

Re: if multiple events at different time, only return most recent events based on a field

salt87 — Sun, 10 Nov 2019 21:03:01 GMT

Hi,

Unfortunately this is not working as it only shows one event for IP3 and not 2 events as shown in the OP screenshot.

This is the output:
IPAddress pluginID _time
IP1 94932 2019-11-01 04:19:23
IP2 46172 2019-11-08 20:32:25
IP3 108797 2019-10-31 02:00:21

What I would like is still keep both events for IP3 as per below:

IPAddress pluginID _time
IP1 94932 2019-11-01 04:19:23
IP2 46172 2019-11-08 20:32:25
IP3 108797 2019-10-31 02:00:21
IP3 84729 2019-10-31 02:00:21

Thanks

Re: if multiple events at different time, only return most recent events based on a field

woodcock — Sun, 10 Nov 2019 22:48:27 GMT

Add this to the bottom of your existing search:

... | streamstats count BY _time IPAddress
| where count == 1

Re: if multiple events at different time, only return most recent events based on a field

woodcock — Sun, 10 Nov 2019 22:49:06 GMT

See my new answer.

Re: if multiple events at different time, only return most recent events based on a field

arjunpkishore5 — Sun, 10 Nov 2019 22:49:30 GMT

looks like latest is converting the mv field to a single value. Edited my answer. Please give it a try.