Splunk Search
Highlighted

How do i filter out all but the most recent results for a particular field

Engager

I'd like to create a search that allows me to filter out all the old results and only give me back the latest result for a given field value.
How can I do this? (similar to the latest in the stats command but for the actual results)

For example given the following results:
2015-05-01 Version:1.34 user:b
2015-04-01 Version:1.2 user:a
2015-03-03 Version: 1.34 user:a
2015-02-03 Version: 1.2 user:b

I only want to see the following:
2015-04-01 Version:1.2 user:a
2015-05-01 Version:1.34 user:b

i.e. I only want to see the latest version per user.

Tags (2)
0 Karma
Highlighted

Re: How do i filter out all but the most recent results for a particular field

Esteemed Legend

Like this:

... | dedup user

View solution in original post

Highlighted

Re: How do i filter out all but the most recent results for a particular field

Engager

Perfect thanks. This worked for me:
dedup user sortby -_time | table...

0 Karma
Highlighted

Re: How do i filter out all but the most recent results for a particular field

Path Finder
0 Karma