Splunk Search

Eventstats not getting the latest event based on the field

Engager

Hi Team,
I am trying to get the latest event from the list of events , id field is common across all the events based on the _time field i need to get the latest event . Appreciate your help here, not sure where i am wrong with the query

Query Used
|eventstats latest(id) by time | table id,time

Results Set
id | _time
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-03-01 19:00:00.000
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-03-01 17:37:37.371
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-03-01 13:00:00.000
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-02-27 01:28:45.888
Applications/Releaseca9d9ce8c9a0448880f47e9ede28def0 | 2019-02-25 06:15:16.000

0 Karma

Splunk Employee
Splunk Employee

I think you have the id and time around the wrong way. Try
`|eventstats latest(
time) as latesttime by by | table id, latesttime`

0 Karma

Engager

I did try in that way .... But as @somesoni2 mentioned it just adding the extra field to all events . It is not singling out as the latest event . Any idea how can i get the latest event based on particular field. I can do subsearch and get it . But the SPL performance could be costly. I believe this a common use case , there should be some inbuilt feature in Splunk

0 Karma

Splunk Employee
Splunk Employee

|eventstats latest(_time) as latest_time by id | table _time, id, latest_time | where _time = latest_time

OR

|eventstats latest(_time) as latest_time by id | table _time, id, latest_time | eval is_latest_event=if( _time = latest_time,1,0)

0 Karma

SplunkTrust
SplunkTrust

The eventstats function just add new fields to existing result based on the your aggregation query. From the resultset, Do you want to get the latest record for the id?? If yes, you can either use | dedup id (which will keep the most recent record OR use | stats max(_time) as _time by id.

0 Karma

Engager

I need other data from that particular event , i cannot just get latest event with the id. I have to use combined key of id and timestamp, So i was hoping eventstats would give me the latest event

I want to get the latest event from the list of transaction with particular field(id). Once i am able to get that i can get other data from that event

0 Karma

SplunkTrust
SplunkTrust

Did you trying dedup??
Also try this

|eventstats latest(id) as latest by _time | where id=latest | table id,_time
0 Karma

Engager

Hey thanks,
i changed like this to use for my case it works
|eventstats latest(_time) as newtime by id | where _time=newtime | table *

0 Karma

SplunkTrust
SplunkTrust

Cool... Also try this a well

...| dedup id
0 Karma