How get a count of last Status

[t_splunk_d]

I trying figure out what is the best search query for reporting on the count of different unique status.
Following is the records:
ID NAME STATUS LASTUPDATEDTIME
1 Group1 Started 12:15
1 Group1 Processing 12:30
1 Group1 Transfering 12:45
1 Group1 Completed 1:06
2 Group1 Started 12:17
2 Group1 Processing 12:32
2 Group1 Transfering 12:46
3 Group1 Started 12:55

When I try | stats count by STATUS - it does give me the correct numbers.
I am looking for the result:

Started - 1
Completed - 1
Transferring - 1

I want to report count of last Status.

Thank you.

[gcusello · Accepted solution]

Hi
let me better understand your request:
each ID can have different status and you want to count only the occurrences of last status of each ID, correct?
If this is your request try something like this:

your_search 
| stats latest(STATUS) AS STATUS by ID 
| stats count by STATUS

Bye.
Giuseppe

[niketn]

@t_splunk_d, | stats count by STATUS should be best way of finding count based on different unique status. Is there any issue that you are facing when you run this command?

[adonio]

count of last status will always give you 1 if i understand the question correctly...
try the following, considering ID field is ID:
... |stats lastest(STATUS) by ID
hope it helps