topic Re: latest function in stats not working without earliest? in Splunk Search

latest function in stats not working without earliest?

vbumgarn — Tue, 06 Mar 2012 04:11:26 GMT

Given the events:

2012-03-06 01:02:00 a=1 b=2
2012-03-06 02:03:00 a=2 b=3

and the query:

* | stats count latest(a) by b

latest(a) is empty. However, if you add earliest(a) to the query, like so:

* | stats count latest(a) earliest(a) by b

then both latest(a) and earliest(a) are populated. earliest also works by itself.

Any idea why latest won't work by itself?

Re: latest function in stats not working without earliest?

rmonge — Mon, 26 Mar 2012 21:16:10 GMT

Thanks for posting this question. I was frustrated about last() working but then latest() had no results. I added earliest() and for some reason latest() worked. It looks like a bug to me.

Re: latest function in stats not working without earliest?

bmgilmore — Mon, 02 Apr 2012 20:59:31 GMT

nice catch. I'd been having the hardest time figuring out why latest only worked sometimes, I just started to use first. Seems like a bug to me!

Re: latest function in stats not working without earliest?

araitz — Wed, 11 Apr 2012 17:13:43 GMT

I filed this as SPL-50131 and I will do my best to update as I have more information.

In the meantime, use the workaround here:

http://splunk-base.splunk.com/answers/45268/stats-latest-not-returning-a-value/45276

Re: latest function in stats not working without earliest?

vbumgarn — Fri, 04 May 2012 19:28:56 GMT

Still broken in 4.3.2. Any idea on when a fix will be in?

Re: latest function in stats not working without earliest?

araitz — Sun, 06 May 2012 16:49:16 GMT

It was always to late for 4.3.2, so I would hope 4.3.3.

Re: latest function in stats not working without earliest?

srowe — Tue, 26 Mar 2013 20:43:50 GMT

Is this supposed to be fixed in 5.0.1? We are having the same issue...what is the workaround?

Re: latest function in stats not working without earliest?

araitz — Tue, 26 Mar 2013 20:47:42 GMT

According to SPL-50131 this was fixed in 4.3.3 and also should be fixed in 5.0.0 through 5.0.2. If this isn't the case, please file a support ticket so we can get the required information from you.

Re: latest function in stats not working without earliest?

caseypike — Fri, 11 Apr 2014 22:24:57 GMT

I am having the same problem in 6.0.1. Sometimes the latest result is returned, sometimes it is blank.

Re: latest function in stats not working without earliest?

shreyans — Mon, 13 Jul 2015 06:56:56 GMT

Hi,

See that stats command need _time field to get latest so if you have query like
index=xyz | tabel t1, t2,t3 | stats latest(t1) by t2,t3

then you will see blank for latest(t1) column

change query like
index=xyz | tabel t1, t2, t3,_time | stats latest(t1) by t2,t3 | fields - _time
OR
index=xyz | stats latest(t1) by t2,t3