https://community.splunk.com/t5/Splunk-Search/Last-record-per-hour/m-p/496662#M194694 <P>Try this:</P> <PRE><CODE>| bin _time span=1h | stats max(Timestamp) by ID, SignalStrength, _time </CODE></PRE> Tue, 17 Mar 2020 11:14:30 GMT manjunathmeti 2020-03-17T11:14:30Z https://community.splunk.com/t5/Splunk-Search/Last-record-per-hour/m-p/496661#M194693 <P>I manage to extract the data from Splunk below:<BR /> ID SignalStrength TimeStamp<BR /> 01 3 09:00:05<BR /> 01 0 09:30:00<BR /> 02 0 09:00:05<BR /> 02 0 09:30:00<BR /> 02 3 09:55:00</P> <P>But I wanted to reduce it further to only get the last record in the hour, like this:<BR /> ID SignalStrength TimeStamp<BR /> 01 0 09:30:00<BR /> 02 3 09:55:00</P> <P>I tried this:<BR /> | stats max(Timestamp) by ID, SignalStrength</P> <P>but it gave me the maximum on the day not per hour.</P> Tue, 17 Mar 2020 04:37:14 GMT https://community.splunk.com/t5/Splunk-Search/Last-record-per-hour/m-p/496661#M194693 627412 2020-03-17T04:37:14Z https://community.splunk.com/t5/Splunk-Search/Last-record-per-hour/m-p/496662#M194694 <P>Try this:</P> <PRE><CODE>| bin _time span=1h | stats max(Timestamp) by ID, SignalStrength, _time </CODE></PRE> Tue, 17 Mar 2020 11:14:30 GMT https://community.splunk.com/t5/Splunk-Search/Last-record-per-hour/m-p/496662#M194694 manjunathmeti 2020-03-17T11:14:30Z