Eventstats not getting the latest event based on the field

[imurpalvicky]

Hi Team,
I am trying to get the latest event from the list of events , id field is common across all the events based on the _time field i need to get the latest event . Appreciate your help here, not sure where i am wrong with the query

Query Used
|eventstats latest(id) by _time | table id,_time

Results Set
id | _time
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-03-01 19:00:00.000
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-03-01 17:37:37.371
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-03-01 13:00:00.000
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-02-27 01:28:45.888
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-02-25 06:15:16.000

[sduff_splunk]

I think you have the id and _time around the wrong way. Try
|eventstats latest(_time) as latest_time by by | table id, latest_time

[imurpalvicky]

I did try in that way .... But as @somesoni2 mentioned it just adding the extra field to all events . It is not singling out as the latest event . Any idea how can i get the latest event based on particular field. I can do subsearch and get it . But the SPL performance could be costly. I believe this a common use case , there should be some inbuilt feature in Splunk

[sduff_splunk]

|eventstats latest(_time) as latest_time by id | table _time, id, latest_time | where _time = latest_time

OR

|eventstats latest(_time) as latest_time by id | table _time, id, latest_time | eval is_latest_event=if( _time = latest_time,1,0)

[somesoni2]

The eventstats function just add new fields to existing result based on the your aggregation query. From the resultset, Do you want to get the latest record for the id?? If yes, you can either use | dedup id (which will keep the most recent record OR use | stats max(_time) as _time by id.

[imurpalvicky]

I need other data from that particular event , i cannot just get latest event with the id. I have to use combined key of id and timestamp, So i was hoping eventstats would give me the latest event

I want to get the latest event from the list of transaction with particular field(id). Once i am able to get that i can get other data from that event

[somesoni2]

Did you trying dedup??
Also try this

|eventstats latest(id) as latest by _time | where id=latest | table id,_time

[imurpalvicky]

Hey thanks,
i changed like this to use for my case it works
|eventstats latest(_time) as newtime by id | where _time=newtime | table *

[somesoni2]

Cool... Also try this a well

...| dedup id