https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148978#M41633 <P>well, <CODE>last()</CODE> will get you the latest events, like you asked. Maybe you have to rephrase your question and provide some more details, like event sample and expected result....</P> Thu, 02 Oct 2014 07:03:56 GMT MuS 2014-10-02T07:03:56Z https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148975#M41630 <P>How do I get latest events for the below search</P> <P>i.e count should get the latest RegistrationState and SessionState if i search for last 15mins or 60mins. Always should get latest events to count. So I can get latest count of Available and Unregistered.</P> <PRE><CODE>index=xx InMaintenanceMode=False |dedup MachineName,RegistrationState | eval avail=if(SessionState=="","t","f")|eval unreg=if(RegistrationState=="Unregistered","t","f") | stats count(eval(avail="t")) AS Available, count(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName </CODE></PRE> Thu, 02 Oct 2014 05:35:22 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148975#M41630 kris99 2014-10-02T05:35:22Z https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148976#M41631 <P>Hi kris99,</P> <P>you can use <CODE>last()</CODE> in your stats <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonStatsFunctions</A></P> <P>something like this should do the job:</P> <PRE><CODE>index=xx InMaintenanceMode=False | dedup MachineName,RegistrationState | eval avail=if(SessionState=="","t","f") | eval unreg=if(RegistrationState=="Unregistered","t","f") | stats count, last(eval(avail="t")) AS Available, last(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName </CODE></PRE> <P>hope this helps ...</P> <P>cheers, MuS</P> Thu, 02 Oct 2014 05:49:46 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148976#M41631 MuS 2014-10-02T05:49:46Z https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148977#M41632 <P>doesn't work.. </P> <P>its adding new count column and returning Available and Unregistered as 1 only </P> Thu, 02 Oct 2014 06:55:40 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148977#M41632 kris99 2014-10-02T06:55:40Z https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148978#M41633 <P>well, <CODE>last()</CODE> will get you the latest events, like you asked. Maybe you have to rephrase your question and provide some more details, like event sample and expected result....</P> Thu, 02 Oct 2014 07:03:56 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148978#M41633 MuS 2014-10-02T07:03:56Z https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148979#M41634 <P>okay maybe I misunderstand your question, but did you try to add <CODE>head</CODE> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Head">http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Head</A> to your search? This will return only the latest events of your base search. Maybe this is what you are after?</P> Thu, 02 Oct 2014 07:53:22 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-events/m-p/148979#M41634 MuS 2014-10-02T07:53:22Z