Splunk Search

How do you get a table of most recent events with multiple fields?

rsrcno
New Member

I have events that are performance metrics taken over time. It includes fields like the sample value and object it pertains to. I want to display a table with that object and the most recent sample value for each object. Right now a query that shows all values would look something like this:

index=custom | table _time, account, metric_name, metric_value

I would like to do a query like

index=custom metric_name=utilization | blah blah

and get a table that includes account, metric_name, metric_value, time, but only show the most recent value for each account/metric_name.

Tags (2)
0 Karma

Vijeta
Influencer

you can do this

index=custom| stats latest(_time) as _time,  latest(metric_value) as metric_value by account metric_name
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...