Splunk Search

Fetch the latest _raw event

zacksoft
Contributor

I have query which goes like this

   sourcetype="A" host=B 
      |rex "^(?:[^ \n]* ){2}(?P<user>\w+)"|rex "^(?:[^ \n]* ){10}(?P<resp_time>\d+)"|rex "^[^ \n]* (?P<txn_id>[^ ]+)"
     |fields user,resp_time,txn_id 
     | sort -resp_time

I want to be able to see the latest _raw event (i.e. the one with maximum resp_time)
Again, I don't want to see the table. I want to see the actual _raw event

Tags (1)
0 Karma

renjith_nair
Legend

Hi @zacksoft,

Just add _raw to your field list or just include |fields resp_time,_raw|sort -resp_time

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...