Splunk Search

How do I locate the latest event and have all the fields in that event available to me?

New Member

I am using the following query to locate the latest event with the field EVENTREF = 50184 or 50185. I believe the correct event is being returned by the stats command but it is not returning all the fields in the returned event for reporting purposes.

Any suggestions?

EVENTREF=50184 OR EVENTREF=50185 | stats latest(EVENTREF) as LatestEvent by TVMREF

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

EVENTREF=50184 OR EVENTREF=50185 | stats latest(EVENTREF) as LatestEvent, values(EVENTREF) as Events by TVMREF
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this

EVENTREF=50184 OR EVENTREF=50185 | stats latest(EVENTREF) as LatestEvent, values(EVENTREF) as Events by TVMREF
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

Thank you! Using 'values' for any field I'd like to access is doing the trick.

0 Karma

SplunkTrust
SplunkTrust

Please accept the answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma