Splunk Search

Count Last event by id and version

cros
Engager

Hi all, 

I'm trying to create a visualisation to show the percentage of ticket status (New, Comleted, Cancelled, etc.). 

I tried with this search : 

 

| stats latest(_time) as Time by "Record Number", PI_Number, PI_Event_Status

 

 

I have ticket with Record Number (id), Number (Version), Status. I want to take the last ticket event of the version and get his status. In order to count the current status of each event on the system. 

The result is the following : 

Record NumberNumberStatus_time
118671141Completed - Owner Action Required1472175180
118671141New1471951740
122975221Completed - Nothing Found1477321800
122975221Investigating1475829120
122975221New1475735400
122975222Completed - Error/Workaround Found1479229260
122975222New1479198300
122975223Completed - Recovery PTR Open1482241320
122975223New1482226920

 

With my stats command i'm not able to retrieve only last event for each version of a ticket. How i can do that ? 

 

Regards,

Clément

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats latest(_time) as Time, latest(PI_Event_Status) as PI_Event_Status by "Record Number", PI_Number
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...