https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157782#M44444 <P>Hello,</P> <P>I try to use the <CODE>latest()</CODE> option of eventstats in the following way:</P> <PRE><CODE>| eventstats latest(Status) AS Status_last by Application |sort 0 _time| dedup _raw| table _time Status Status_last </CODE></PRE> <P>In fact, I used a regex to define "Status" in a log line and I want to display the Current Status (current log line) and the status value of the previous logs line. </P> <P>As below the problem is the Status_last raised is not good. </P> <P>_time Status Status_last<BR /> 2015-03-31 19:28:05 DEGRADED OPERATIONAL <BR /> 2015-03-31 19:29:05 OPERATIONAL <STRONG>OPERATIONAL</STRONG> &lt;= instead of Degraded</P> <P>Please help ! !!</P> Tue, 29 Sep 2020 06:54:11 GMT collier31200 2020-09-29T06:54:11Z https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157782#M44444 <P>Hello,</P> <P>I try to use the <CODE>latest()</CODE> option of eventstats in the following way:</P> <PRE><CODE>| eventstats latest(Status) AS Status_last by Application |sort 0 _time| dedup _raw| table _time Status Status_last </CODE></PRE> <P>In fact, I used a regex to define "Status" in a log line and I want to display the Current Status (current log line) and the status value of the previous logs line. </P> <P>As below the problem is the Status_last raised is not good. </P> <P>_time Status Status_last<BR /> 2015-03-31 19:28:05 DEGRADED OPERATIONAL <BR /> 2015-03-31 19:29:05 OPERATIONAL <STRONG>OPERATIONAL</STRONG> &lt;= instead of Degraded</P> <P>Please help ! !!</P> Tue, 29 Sep 2020 06:54:11 GMT https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157782#M44444 collier31200 2020-09-29T06:54:11Z https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157783#M44445 <P><CODE>latest(Status)</CODE> finds the most recent value of <CODE>Status</CODE>, not the previous value.</P> Mon, 10 Aug 2015 13:07:46 GMT https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157783#M44445 richgalloway 2015-08-10T13:07:46Z https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157784#M44446 <P>Therefore how could I find the previous value ?</P> Mon, 10 Aug 2015 13:14:49 GMT https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157784#M44446 collier31200 2015-08-10T13:14:49Z https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157785#M44447 <P>OK, like this:</P> <PRE><CODE>... | dedup _raw | reverse | streamstats current=f last(Status) AS PrevStatus BY Application | reverse | dedup Application | table _time Applicatoin Status PrevStatus </CODE></PRE> Mon, 10 Aug 2015 13:22:29 GMT https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157785#M44447 woodcock 2015-08-10T13:22:29Z https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157786#M44448 <P>Perfect ! That's work ! Thanks a lot</P> Mon, 10 Aug 2015 13:27:38 GMT https://community.splunk.com/t5/Splunk-Search/latest-for-eventstats-does-not-work/m-p/157786#M44448 collier31200 2015-08-10T13:27:38Z