topic How can I get the latest result? in Splunk Search

How can I get the latest result?

abi2023 — Mon, 01 May 2023 16:49:06 GMT

my spl
base search |transaction ID | table date field1 field2 ID

my result

Date field1 fiel2 ID
02/20/23 CCC 2k 10

02/20/23 c2 4k 11

02/10/23. CC 2k 08

02/01/23 C 5k 01

but I only want to output latest result which 02/20/23 assuming begin of the I don't date for latest event.

somesoni2 — Mon, 01 May 2023 16:42:08 GMT

Give this a try

bowesmana — Tue, 02 May 2023 04:05:05 GMT

Is your date field different to _time? Also, you have two dates the same value, but if date is different to _time then do this

base search | transaction ID | eval tmp=strptime(date, "%m/%d/%y") | sort 1 - tmp | table date field1 field2 ID

if date is the same as _time then you just need

base search | transaction ID | sort 1 - _time | table date field1 field2 ID

but how do you want to differentiate between the first two events that have the same date?