topic Re: How would I count by a most recent event value? in Splunk Search

How would I count by a most recent event value?

splunkingjh — Mon, 03 Oct 2016 14:57:50 GMT

The value that I need to count can be in multiple events. I just want to count it one time, but it will need to be the most recent value counted.

Re: How would I count by a most recent event value?

somesoni2 — Mon, 03 Oct 2016 16:11:45 GMT

Without much information, I would suggest to give these a try

index=foo sourcetype=bar yourfield=yourvalue | head 1 | table yourfield

index=foo sourcetype=bar | stats latest(yourfield) as yourfield

Re: How would I count by a most recent event value?

splunkingjh — Mon, 03 Oct 2016 16:57:17 GMT

The second option seems to pull back the most recent. Is there a way that I can count all of those values? I am trying to parse HL7 data. It has presented quite the challenge. I am trying to provide a visual that will show active counts across the facility of different events.

Re: How would I count by a most recent event value?

somesoni2 — Mon, 03 Oct 2016 17:24:54 GMT

By "Is there a way that I can count all of those values", Do you mean that you want to count the event which has the same value for field yourfield as in the latest event? If yes, then try something like this (if no, provide more info)

index=foo sourcetype=bar [ search index=foo sourcetype=bar | stats latest(yourfield) as yourfield] | stats count by yourfield

Re: How would I count by a most recent event value?

sundareshr — Mon, 03 Oct 2016 17:47:48 GMT

Try this, assuming the values are extracted in a field called yourField

index=foo sourcetype=bar | stats dc(yourField) as yourField by facility

*OR*

index=foo sourcetype=bar | timechart span=1h latest(yourField) as yourField by facility