https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126450#M34242 <P>Try this,</P> <PRE><CODE>index=sw sourcetype=package |bucket _time span=24h|sort - version|dedup host,_time| timechart dc(host) as host by version </CODE></PRE> <P>Thanks</P> Wed, 09 Apr 2014 20:57:52 GMT linu1988 2014-04-09T20:57:52Z https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126449#M34241 <P>I am trying to build a timechart in 24-hr increments which shows a count of hosts by version of a software package. However, there are cases where during those 24-hr spans, more than one version is present, and this makes the below search return more hosts than I have. I only want the most recent (highest) version to be returned, but I can't make the search logic work for me.</P> <P>The search is:</P> <P><CODE>index=sw sourcetype=package | timechart span=24h dc(host) by version</CODE></P> <P>If I add dedup to hosts before the timechart stanza, of course, I only get one event per host for the entire week. I've fumbled around with latest, and last, but haven't gotten a good outcome. </P> <P>Could anyone suggest an appropriate search to take days in which two host/version combinations appear and remove the events with the lowest version number?</P> <P>Thank you.</P> Wed, 09 Apr 2014 20:35:29 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126449#M34241 essklau 2014-04-09T20:35:29Z https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126450#M34242 <P>Try this,</P> <PRE><CODE>index=sw sourcetype=package |bucket _time span=24h|sort - version|dedup host,_time| timechart dc(host) as host by version </CODE></PRE> <P>Thanks</P> Wed, 09 Apr 2014 20:57:52 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126450#M34242 linu1988 2014-04-09T20:57:52Z https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126451#M34243 <P>Try this,</P> <PRE><CODE>index=sw sourcetype=package | eventstats latest(version) as versionToUse | where version=versionToUse| timechart span=24h dc(host) by version </CODE></PRE> <P>OR </P> <PRE><CODE>index=sw sourcetype=package [index=sw sourcetype=package | head 1 | table version]| timechart span=24h dc(host) by version </CODE></PRE> Wed, 09 Apr 2014 21:06:36 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126451#M34243 somesoni2 2014-04-09T21:06:36Z https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126452#M34244 <P>you meant last(version) that would be the latest</P> Wed, 09 Apr 2014 21:12:10 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126452#M34244 linu1988 2014-04-09T21:12:10Z https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126453#M34245 <P>Since Splunk gives result in chronological order of _time, I believe first should be the one appearing on top . Best option would be to use 'latest'. Will update the answer.</P> Wed, 09 Apr 2014 21:17:25 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126453#M34245 somesoni2 2014-04-09T21:17:25Z https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126454#M34246 <P>This should be faster than doing <CODE>sort | dedup</CODE>, and doesn't rely on sortable versions:</P> <PRE><CODE>index=sw sourcetype=package | bucket span=24h _time as day | stats latest(version) as version by host day | rename day as _time | timechart dc(host) by version </CODE></PRE> <P>The fiddling with the temporary <CODE>day</CODE> field is necessary to determine the <CODE>latest(version)</CODE> after bucketing the <CODE>_time</CODE> down to whole days.</P> Wed, 09 Apr 2014 22:20:05 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126454#M34246 martin_mueller 2014-04-09T22:20:05Z https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126455#M34247 <P>Martin, tried yours with great success. Thank you.</P> Thu, 10 Apr 2014 13:03:58 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126455#M34247 essklau 2014-04-10T13:03:58Z https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126456#M34248 <P>Cool... I've promoted the comment to an answer so you can mark it as solved.</P> Thu, 10 Apr 2014 13:16:25 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126456#M34248 martin_mueller 2014-04-10T13:16:25Z https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126457#M34249 <P>VERY cool, thanks Martin!</P> Fri, 16 Jan 2015 00:12:34 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-how-to-exclude-one-of-two-unique-values-in-a-timechart/m-p/126457#M34249 helge 2015-01-16T00:12:34Z