https://community.splunk.com/t5/Splunk-Search/How-to-select-one-event-from-a-transaction/m-p/308175#M92463 <P>@juanpavergara... do you need only one event for each JSESSIONID with only the latest event(or you need correlated events as well with time of transaction as latest time?)<BR /> Instead of transaction you should try dedup command, as transaction will be very expensive command specially when you do not need correlated event rather just the latest event. Since latest data is fetched first, dedup will get only the latest match for each JSESSIONID</P> <PRE><CODE>date_month="march" date_mday&gt;="25" date_mday&lt;="26" | dedup JSESSIONID | table _time JSESSIONID _raw </CODE></PRE> <P>Instead of _raw you can select specific fields you need.</P> Sat, 01 Apr 2017 19:06:46 GMT niketn 2017-04-01T19:06:46Z https://community.splunk.com/t5/Splunk-Search/How-to-select-one-event-from-a-transaction/m-p/308173#M92461 <P>I need to group the events (in this case by JSESSIONID) and select the one with the max date </P> <P>I have the groups with the following query:</P> <P><CODE>date_month="march" date_mday&gt;="25" date_mday&lt;="26" | transaction JSESSIONID</CODE></P> <P>How can I get every transaction only with the newest event?</P> <P>TKS!</P> Sat, 01 Apr 2017 01:12:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-one-event-from-a-transaction/m-p/308173#M92461 juanpavergara 2017-04-01T01:12:15Z https://community.splunk.com/t5/Splunk-Search/How-to-select-one-event-from-a-transaction/m-p/308174#M92462 <P>hi<BR /> can u please try</P> <PRE><CODE>date_month="march" date_mday&gt;="25" date_mday&lt;="26" | transaction JSESSIONID | stats latest(JSESSIONID) </CODE></PRE> <P>may be you can try any of the option try to fit whichever best</P> <PRE><CODE>first(JSESSIONID) latest(JSESSIONID) last(JSESSIONID) earliest(JSESSIONID) </CODE></PRE> Sat, 01 Apr 2017 18:51:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-one-event-from-a-transaction/m-p/308174#M92462 koshyk 2017-04-01T18:51:11Z https://community.splunk.com/t5/Splunk-Search/How-to-select-one-event-from-a-transaction/m-p/308175#M92463 <P>@juanpavergara... do you need only one event for each JSESSIONID with only the latest event(or you need correlated events as well with time of transaction as latest time?)<BR /> Instead of transaction you should try dedup command, as transaction will be very expensive command specially when you do not need correlated event rather just the latest event. Since latest data is fetched first, dedup will get only the latest match for each JSESSIONID</P> <PRE><CODE>date_month="march" date_mday&gt;="25" date_mday&lt;="26" | dedup JSESSIONID | table _time JSESSIONID _raw </CODE></PRE> <P>Instead of _raw you can select specific fields you need.</P> Sat, 01 Apr 2017 19:06:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-one-event-from-a-transaction/m-p/308175#M92463 niketn 2017-04-01T19:06:46Z