topic Re: get latest record based on custom time field in Splunk Search

get latest record based on custom time field

dsiob — Wed, 12 Jul 2017 07:06:02 GMT

I have a excel input having columns-> Id, UpdateTime, Desription, AssignedTo, StartTime
having Values like

Id UpdateTime Description AssignedTo
1 7/12/17 4:00 XYZ Sam
1 7/12/17 8:00 XYZ Tom
2 7/12/17 4:00 ABC Dan
2 7/12/17 8:00 ABC Kaly

result should be:
Id UpdateTime Description AssignedTo
1 7/12/17 8:00 XYZ Tom
2 7/12/17 8:00 ABC Kaly

I need to fetch the latest record of each Id as per UpdateTime.
'StartTime' field is already _time in existing query serving other purpose.

somesoni2 — Wed, 12 Jul 2017 14:06:38 GMT

Try like this

your current search giving fields Id UpdateTime Description AssignedTo
| eval _time=strptime(UpdateTime,"%m/%d/%y") 
| sort 0 -_time | dedup Id

dsiob — Fri, 14 Jul 2017 14:44:30 GMT

I did it like this :

current search here
| sort -Id, -UpdateDateTime
| dedup Id
| table Id UpdateTime Description AssignedTo

it's working.

dsiob — Fri, 14 Jul 2017 14:45:40 GMT

thanks someonei2 for reply