How to extract the latest scope with respect to latest date?

[smanojkumar]

date Scope

12/11/2020	Linux Shadow
17/02/2023	Linux Project
20/02/2023	Linux Project
21/02/2023	Linux Project
22/02/2023	Linux Project
23/02/2023	Linux Project
24/02/2023	Linux Project
27/02/2023	Linux Project
28/02/2023	Linux Project
01/03/2023	Linux Project
01/03/2023	Linux Project
01/03/2023	Linux Project
02/03/2023	Linux projet
03/03/2023	Linux Project
03/03/2023	Linux Project
06/03/2023	Linux Project
06/03/2023	Linux Project

we need to extract the lastest scope with respect to latest date, 

The latest date is 06/03/2023, so its scope is linux project, we need to get this value and the result will be

date Scope

01/03/2023 02/03/2023 03/03/2023 06/03/2023 12/11/2020 17/02/2023 20/02/2023 21/02/2023 22/02/2023 23/02/2023 24/02/2023 27/02/2023 28/02/2023

Linux Project

[smanojkumar]

Hi @ITWhisperer ,

   Thanks for your response,

   I had added some details in original post, also the data is from kvstore lookup.

Thanks Again!

[ITWhisperer · Accepted solution]

You should probably parse the dates from the kvstore into epoch timestamps, that way you can do calculations on them such as finding the latest date

| eval epoch = strptime(date,"%d/%m/%Y")
| eventstats max(epoch) as latest_date
| where epoch=latest_date

[ITWhisperer]

It is not clear what you are trying to do as you have multiple dates for the same scope.

Does this do what you want?

| stats latest(Date) as Date by Scope

If not, please share some of the events you are dealing with (anonymised of course), preferably in a code block </> to prevent format information from being removed.