Splunk Search

How do i filter out all but the most recent results for a particular field

musgrape
Engager

I'd like to create a search that allows me to filter out all the old results and only give me back the latest result for a given field value.
How can I do this? (similar to the latest in the stats command but for the actual results)

For example given the following results:
2015-05-01 Version:1.34 user:b
2015-04-01 Version:1.2 user:a
2015-03-03 Version: 1.34 user:a
2015-02-03 Version: 1.2 user:b

I only want to see the following:
2015-04-01 Version:1.2 user:a
2015-05-01 Version:1.34 user:b

i.e. I only want to see the latest version per user.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | dedup user

View solution in original post

cmeinco
Path Finder
0 Karma

woodcock
Esteemed Legend

Like this:

... | dedup user

musgrape
Engager

Perfect thanks. This worked for me:
dedup user sortby -_time | table...

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...