How to find the latest value grouped by field

[AravindSridhara]

I have multiple Queues and I have created a field X_Queuename, and in the message management logs, I get a number of messages processed at regular intervals and I created field MessageCount. I want to get the latest processed message for each queue in a table format.

Dashboard should look like

QueueName     ProcessedMessage 
Queue1        13000
Queue2        497

[somesoni2]

Try something like this

your base search | stats latest(ProcessedMessage) as ProcessedMessage by QueueName

OR

your base search | dedup QueueName | table QueueName ProcessedMessage 

[AravindSridhara]

Thanks it worked

[ppablo]

Hi @AravindSridharamoorthy

Glad you found a solution through @somesoni2. Don't forget to resolve the post by clicking "Accept" directly below his answer. Also be sure to upvote his answer for helping you out. Thanks!

Patrick

[richgalloway]

What is your current search query?