How do I find the latest time project name in each group?

[flzhang132]

I want to group by virtual machine and then find the latest time project name in each group. How would I implement this?

thanks!

[kamlesh_vaghela]

@flzhang132

Have you tried this?

YOUR_SEARCH
| stats latest(project) as project latest(_time) as _time by vm_id

Sample Search:

| makeresults | eval project="erp",vm_id=100,_time=now()-180 | append [| makeresults | eval project="erp",vm_id=100,_time=now()-120] | append [| makeresults | eval project="ems",vm_id=100,_time=now()-60] | append [| makeresults | eval project="mcs",vm_id=101,_time=now()-180] | append [| makeresults | eval project="mcs",vm_id=101,_time=now()-120] | append [| makeresults | eval project="mes",vm_id=101,_time=now()-60] | stats latest(project) as project latest(_time) as _time by vm_id

Thanks

[493669]

try this:

|stats latest(time) by vm_id project

[flzhang132]

no,no,no ,the result of this way is

I need latest time project name in each group. and there is only one data in each group