How to edit my search to select the newest event based on LastModTime field?

[joesrepsol]

So I'm taking in data from a source that has some duplicate records for the same ID. The only differentiator between events is a "LastModTime" field value, which is an integer. larger number means most recent change.

So I'm trying to write a Splunk search to get all the events from this data source, and where multiple ID exists, only give me the most recent event (i.e. LastModTime is the largest value). Sounded so easy to say, but proving to be a challenge with mvindex command and now I'm stumped.

ID LastModTime Counter
108 1495147243 1
109 1495152331 1
110 1495207972 1
111 1495205705 1
112 1495207542 1
113 1495209093 1 I only want this event out of all the ID=113 events
113 1495217660 1
113 1495218310 1
113 1495222596 1
114 1495211855 1
115 1495212746 1

help?

[somesoni2]

Assuming that your _time value is setup based on LastModTime field and you get one ID in one event/row, try this

your base search | dedup ID

It should keep only the latest record for every ID if it appears more that once.

If your _time field is not based on LastModTime field, try this

yourbase search | sort 0 ID -LastModTime | dedup ID

[joesrepsol]

That worked perfect! Thank you!

yourbase search | sort 0 ID -LastModTime | dedup ID