https://community.splunk.com/t5/Splunk-Search/How-do-i-filter-out-all-but-the-most-recent-results-for-a/m-p/157820#M44457 <P>Like this:</P> <PRE><CODE>... | dedup user </CODE></PRE> Tue, 16 Jun 2015 03:21:47 GMT woodcock 2015-06-16T03:21:47Z https://community.splunk.com/t5/Splunk-Search/How-do-i-filter-out-all-but-the-most-recent-results-for-a/m-p/157819#M44456 <P>I'd like to create a search that allows me to filter out all the old results and only give me back the latest result for a given field value.<BR /> How can I do this? (similar to the latest in the stats command but for the actual results)</P> <P>For example given the following results:<BR /> 2015-05-01 Version:1.34 user:b<BR /> 2015-04-01 Version:1.2 user:a<BR /> 2015-03-03 Version: 1.34 user:a<BR /> 2015-02-03 Version: 1.2 user:b</P> <P>I only want to see the following:<BR /> 2015-04-01 Version:1.2 user:a<BR /> 2015-05-01 Version:1.34 user:b</P> <P>i.e. I only want to see the latest version per user.</P> Tue, 16 Jun 2015 02:56:17 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-filter-out-all-but-the-most-recent-results-for-a/m-p/157819#M44456 musgrape 2015-06-16T02:56:17Z https://community.splunk.com/t5/Splunk-Search/How-do-i-filter-out-all-but-the-most-recent-results-for-a/m-p/157820#M44457 <P>Like this:</P> <PRE><CODE>... | dedup user </CODE></PRE> Tue, 16 Jun 2015 03:21:47 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-filter-out-all-but-the-most-recent-results-for-a/m-p/157820#M44457 woodcock 2015-06-16T03:21:47Z https://community.splunk.com/t5/Splunk-Search/How-do-i-filter-out-all-but-the-most-recent-results-for-a/m-p/157821#M44458 <P>use the last function:</P> <BLOCKQUOTE> <P>stats last(version) by user</P> </BLOCKQUOTE> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonStatsFunctions</A></P> Tue, 16 Jun 2015 03:28:31 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-filter-out-all-but-the-most-recent-results-for-a/m-p/157821#M44458 cmeinco 2015-06-16T03:28:31Z https://community.splunk.com/t5/Splunk-Search/How-do-i-filter-out-all-but-the-most-recent-results-for-a/m-p/157822#M44459 <P>Perfect thanks. This worked for me:<BR /> dedup user sortby -_time | table...</P> Tue, 16 Jun 2015 05:26:08 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-filter-out-all-but-the-most-recent-results-for-a/m-p/157822#M44459 musgrape 2015-06-16T05:26:08Z