https://community.splunk.com/t5/Splunk-Search/Splunk-Query/m-p/581431#M202558 <LI-CODE lang="markup">| stats latest(status) as status by router | where status="failed"</LI-CODE> Tue, 18 Jan 2022 08:32:33 GMT ITWhisperer 2022-01-18T08:32:33Z https://community.splunk.com/t5/Splunk-Search/Splunk-Query/m-p/581428#M202555 <P>If i have n numbers of router in my index&nbsp; and i want to know the current status of router if its connected or failed , if its is failed i need to show the router number of the failed router how to display the router number instead of router count , what query i should write&nbsp;&nbsp;</P> Tue, 18 Jan 2022 07:48:46 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Query/m-p/581428#M202555 i_am_manish 2022-01-18T07:48:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-Query/m-p/581429#M202556 <P>Can you give some sample data (please use &lt;/&gt; when you post it)?&nbsp;</P> Tue, 18 Jan 2022 08:05:16 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Query/m-p/581429#M202556 isoutamo 2022-01-18T08:05:16Z https://community.splunk.com/t5/Splunk-Search/Splunk-Query/m-p/581431#M202558 <LI-CODE lang="markup">| stats latest(status) as status by router | where status="failed"</LI-CODE> Tue, 18 Jan 2022 08:32:33 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Query/m-p/581431#M202558 ITWhisperer 2022-01-18T08:32:33Z