https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610522#M212333 <P><SPAN>_time&nbsp; id status&nbsp;</SPAN></P><P>1&nbsp; &nbsp; &nbsp; &nbsp; x&nbsp; &nbsp; &nbsp;yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;x&nbsp; &nbsp; &nbsp;no</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x&nbsp; &nbsp; &nbsp; yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x&nbsp; &nbsp; &nbsp; unknow&nbsp;</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; y&nbsp; &nbsp; &nbsp;yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;y&nbsp; &nbsp; &nbsp;no</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;y&nbsp; &nbsp; yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; y&nbsp; &nbsp; &nbsp; unknow&nbsp;</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;z &nbsp; yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; z&nbsp; &nbsp; unknow&nbsp;</P> Tue, 23 Aug 2022 16:01:56 GMT yangadounb 2022-08-23T16:01:56Z https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610501#M212320 <P>I have the record like this:&nbsp;&nbsp;</P> <P>&nbsp;</P> <P>_time&nbsp; id status&nbsp;</P> <P>1&nbsp; &nbsp; &nbsp; &nbsp; x&nbsp; &nbsp; &nbsp;yes</P> <P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;x&nbsp; &nbsp; &nbsp;no</P> <P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x&nbsp; &nbsp; &nbsp; yes</P> <P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x&nbsp; &nbsp; &nbsp; unknow&nbsp;</P> <P>&nbsp;</P> <P>I want to return the record based on status value: if status has yes ,then return the lasted row that has yes. if there is none yes value then I want the row with no,&nbsp; if there is none yes or none no, return unknow row.</P> Tue, 23 Aug 2022 21:17:00 GMT https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610501#M212320 yangadounb 2022-08-23T21:17:00Z https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610510#M212326 <LI-CODE lang="markup">| eval stat=case(status="yes",0,status="no",1,status="unknow",2) | sort 0 stat - _time | head 1</LI-CODE> Tue, 23 Aug 2022 15:09:49 GMT https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610510#M212326 ITWhisperer 2022-08-23T15:09:49Z https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610522#M212333 <P><SPAN>_time&nbsp; id status&nbsp;</SPAN></P><P>1&nbsp; &nbsp; &nbsp; &nbsp; x&nbsp; &nbsp; &nbsp;yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;x&nbsp; &nbsp; &nbsp;no</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x&nbsp; &nbsp; &nbsp; yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; x&nbsp; &nbsp; &nbsp; unknow&nbsp;</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; y&nbsp; &nbsp; &nbsp;yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;y&nbsp; &nbsp; &nbsp;no</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;y&nbsp; &nbsp; yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; y&nbsp; &nbsp; &nbsp; unknow&nbsp;</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;z &nbsp; yes</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; z&nbsp; &nbsp; unknow&nbsp;</P> Tue, 23 Aug 2022 16:01:56 GMT https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610522#M212333 yangadounb 2022-08-23T16:01:56Z https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610523#M212334 <P>sorry not to make this clear ,&nbsp; I have more records than that.&nbsp;</P> Tue, 23 Aug 2022 16:03:24 GMT https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610523#M212334 yangadounb 2022-08-23T16:03:24Z https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610525#M212336 <LI-CODE lang="markup">| eval stat=case(status="yes",0,status="no",1,status="unknow",2) | sort 0 stat - _time | streamstats count by id | where count = 1</LI-CODE> Tue, 23 Aug 2022 16:29:22 GMT https://community.splunk.com/t5/Splunk-Search/Help-on-this-record-select/m-p/610525#M212336 ITWhisperer 2022-08-23T16:29:22Z