Splunk Search

Eventstats not getting the latest event based on the field

imurpalvicky
Engager

Hi Team,
I am trying to get the latest event from the list of events , id field is common across all the events based on the _time field i need to get the latest event . Appreciate your help here, not sure where i am wrong with the query

Query Used
|eventstats latest(id) by _time | table id,_time

Results Set
id | _time
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-03-01 19:00:00.000
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-03-01 17:37:37.371
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-03-01 13:00:00.000
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-02-27 01:28:45.888
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-02-25 06:15:16.000

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

I think you have the id and _time around the wrong way. Try
|eventstats latest(_time) as latest_time by by | table id, latest_time

0 Karma

imurpalvicky
Engager

I did try in that way .... But as @somesoni2 mentioned it just adding the extra field to all events . It is not singling out as the latest event . Any idea how can i get the latest event based on particular field. I can do subsearch and get it . But the SPL performance could be costly. I believe this a common use case , there should be some inbuilt feature in Splunk

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

|eventstats latest(_time) as latest_time by id | table _time, id, latest_time | where _time = latest_time

OR

|eventstats latest(_time) as latest_time by id | table _time, id, latest_time | eval is_latest_event=if( _time = latest_time,1,0)

0 Karma

somesoni2
Revered Legend

The eventstats function just add new fields to existing result based on the your aggregation query. From the resultset, Do you want to get the latest record for the id?? If yes, you can either use | dedup id (which will keep the most recent record OR use | stats max(_time) as _time by id.

0 Karma

imurpalvicky
Engager

I need other data from that particular event , i cannot just get latest event with the id. I have to use combined key of id and timestamp, So i was hoping eventstats would give me the latest event

I want to get the latest event from the list of transaction with particular field(id). Once i am able to get that i can get other data from that event

0 Karma

somesoni2
Revered Legend

Did you trying dedup??
Also try this

|eventstats latest(id) as latest by _time | where id=latest | table id,_time
0 Karma

imurpalvicky
Engager

Hey thanks,
i changed like this to use for my case it works
|eventstats latest(_time) as newtime by id | where _time=newtime | table *

0 Karma

somesoni2
Revered Legend

Cool... Also try this a well

...| dedup id
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...