https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-select-the-newest-event-based-on/m-p/304345#M91519 <P>That worked perfect! Thank you!</P> <P>yourbase search | sort 0 ID -LastModTime | dedup ID</P> Fri, 19 May 2017 21:34:36 GMT joesrepsol 2017-05-19T21:34:36Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-select-the-newest-event-based-on/m-p/304343#M91517 <P>So I'm taking in data from a source that has some duplicate records for the same ID. The only differentiator between events is a "LastModTime" field value, which is an integer. larger number means most recent change.</P> <P>So I'm trying to write a Splunk search to get all the events from this data source, and where multiple ID exists, only give me the most recent event (i.e. LastModTime is the largest value). Sounded so easy to say, but proving to be a challenge with mvindex command and now I'm stumped.</P> <P>ID LastModTime Counter<BR /> 108 1495147243 1<BR /> 109 1495152331 1<BR /> 110 1495207972 1<BR /> 111 1495205705 1<BR /> 112 1495207542 1<BR /> <STRONG>113 1495209093 1 I only want this event out of all the ID=113 events<BR /> 113 1495217660 1<BR /> 113 1495218310 1<BR /> 113 1495222596 1</STRONG><BR /> 114 1495211855 1<BR /> 115 1495212746 1 </P> <P>help?</P> Fri, 19 May 2017 21:06:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-select-the-newest-event-based-on/m-p/304343#M91517 joesrepsol 2017-05-19T21:06:18Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-select-the-newest-event-based-on/m-p/304344#M91518 <P>Assuming that your _time value is setup based on LastModTime field and you get one ID in one event/row, try this</P> <PRE><CODE>your base search | dedup ID </CODE></PRE> <P>It should keep only the latest record for every ID if it appears more that once.</P> <P>If your _time field is not based on LastModTime field, try this</P> <PRE><CODE>yourbase search | sort 0 ID -LastModTime | dedup ID </CODE></PRE> Fri, 19 May 2017 21:11:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-select-the-newest-event-based-on/m-p/304344#M91518 somesoni2 2017-05-19T21:11:43Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-select-the-newest-event-based-on/m-p/304345#M91519 <P>That worked perfect! Thank you!</P> <P>yourbase search | sort 0 ID -LastModTime | dedup ID</P> Fri, 19 May 2017 21:34:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-select-the-newest-event-based-on/m-p/304345#M91519 joesrepsol 2017-05-19T21:34:36Z