Splunk Search

How do you get a table of most recent events with multiple fields?

rsrcno
New Member

I have events that are performance metrics taken over time. It includes fields like the sample value and object it pertains to. I want to display a table with that object and the most recent sample value for each object. Right now a query that shows all values would look something like this:

index=custom | table _time, account, metric_name, metric_value

I would like to do a query like

index=custom metric_name=utilization | blah blah

and get a table that includes account, metric_name, metric_value, time, but only show the most recent value for each account/metric_name.

Tags (2)
0 Karma

Vijeta
Influencer

you can do this

index=custom| stats latest(_time) as _time,  latest(metric_value) as metric_value by account metric_name
0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...