https://community.splunk.com/t5/Splunk-Search/How-to-select-one-of-two-event-fields-in-stats/m-p/604991#M210407 <P>Yes, it is. That worked perfectly. Thank you!</P> Fri, 08 Jul 2022 18:05:13 GMT user33 2022-07-08T18:05:13Z https://community.splunk.com/t5/Splunk-Search/How-to-select-one-of-two-event-fields-in-stats/m-p/604981#M210404 <P>Hi,&nbsp;</P> <P>I have two event fields with the same name "timestamp". I just want to display (in stats) the "timestamp" field from the "ResponseReceive" logEventType. Not the one from logType "SystemLog". Currently is displays both.&nbsp; Is there a way to do this? Any assistance is appreciated. Thank you!!</P> <PRE><EM>...</EM><BR />| fields timestamp, apiName, apiVersion, ceoCompanyId, entityId, sessionId, transactionDetailsResponse.transactionDetailsList.totalCount, transactionDetailsResponse.transactionDetailsList.transactionDetails{}.acctNumber, transactionDetailsResponse.transactionDetailsList.transactionDetails{}.Amount, transactionDetailsResponse.transactionDetailsList.transactionDetails{}.tranDateTime, transactionDetailsResponse.transactionDetailsList.transactionDetails{}.totalTranCount<BR />| rename transactionDetailsResponse.transactionDetailsList.totalCount AS "TransactionCount", transactionDetailsResponse.transactionDetailsList.transactionDetails{}.acctNumber AS "AcctNum", transactionDetailsResponse.transactionDetailsList.transactionDetails{}.Amount AS "Amount", transactionDetailsResponse.transactionDetailsList.transactionDetails{}.tranDateTime AS "TranDateTime", transactionDetailsResponse.transactionDetailsList.transactionDetails{}.totalTranCount AS "TotalTranCount"<BR />| stats<BR />values(timestamp) AS timestamp,<BR />values(TranDateTime) AS TranDateTime,<BR />values(apiName) AS apiName,<BR />values(apiVersion) AS apiVersion,<BR />values(ceoCompanyId) AS ceoCompanyId,<BR />values(entityId) AS entityId,<BR />values(TotalTranCount) AS TotalTranCount,<BR />values(AcctNum) AS AcctNum,<BR />by sessionId,</PRE> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="user33_0-1657300216455.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/20466iB55862FEE50DCA2D/image-size/medium?v=v2&amp;px=400" role="button" title="user33_0-1657300216455.png" alt="user33_0-1657300216455.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="user33_1-1657300249200.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/20467i23BB1F4D0B20B161/image-size/medium?v=v2&amp;px=400" role="button" title="user33_1-1657300249200.png" alt="user33_1-1657300249200.png" /></span></P> <P>&nbsp;</P> Fri, 08 Jul 2022 20:32:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-one-of-two-event-fields-in-stats/m-p/604981#M210404 user33 2022-07-08T20:32:49Z https://community.splunk.com/t5/Splunk-Search/How-to-select-one-of-two-event-fields-in-stats/m-p/604982#M210405 <P>Hello&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/247156">@user33</a>&nbsp;,</P><P>Will the "<SPAN>ResponseReceive" always be received after the "SystemLog", I mean, will the timestamp of the ResponseReceive always be latest than the SystemLog timestamp?</SPAN></P><P><SPAN>If yes, you could use the <STRONG>"latest"</STRONG> command from <STRONG>stats.</STRONG></SPAN></P><P>For example:<BR /></P><LI-CODE lang="markup">| stats latest(timestamp) AS timestamp by sessionId</LI-CODE><P>&nbsp;</P> Fri, 08 Jul 2022 17:21:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-one-of-two-event-fields-in-stats/m-p/604982#M210405 danielcj 2022-07-08T17:21:50Z https://community.splunk.com/t5/Splunk-Search/How-to-select-one-of-two-event-fields-in-stats/m-p/604991#M210407 <P>Yes, it is. That worked perfectly. Thank you!</P> Fri, 08 Jul 2022 18:05:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-one-of-two-event-fields-in-stats/m-p/604991#M210407 user33 2022-07-08T18:05:13Z