How to get most recent event(based on message) and compare with other events and return the result with latest timestamp

[prathyusha89]

Let's say, we have 3 different events ( 2 with Failure messages and 1 with reconfigured message) based on the service name and timestamp.

Event 1 : 
2022-07-25 08:29:38.516 service_name=addtocart message=failure
Event 2:
2022-07-25 08:29:35.516 service_name=addtocart message=reconfigured
Event 3:
2022-07-25 08:29:30.516 service_name=addtocart message=failure

Output should be as :
Which service is failed and not reconfigured again based on the latest timestamp

_time	service_name	message
2022-07-25 08:29:38.516	addtocart	failure

[richgalloway]

The dedup command will return the most recent event with distinct value of a given field.  For example,

| dedup service_name

 will return the latest message from the addtocart service, which is the desired event from the example.