Splunk Search

How do you get a table of most recent events with multiple fields?

rsrcno
New Member

I have events that are performance metrics taken over time. It includes fields like the sample value and object it pertains to. I want to display a table with that object and the most recent sample value for each object. Right now a query that shows all values would look something like this:

index=custom | table _time, account, metric_name, metric_value

I would like to do a query like

index=custom metric_name=utilization | blah blah

and get a table that includes account, metric_name, metric_value, time, but only show the most recent value for each account/metric_name.

Tags (2)
0 Karma

Vijeta
Influencer

you can do this

index=custom| stats latest(_time) as _time,  latest(metric_value) as metric_value by account metric_name
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...