Splunk Search

How to get most recent results based on field value?

Explorer

Hi,

I'm trying to get the results based on recent field value. How to filter the events with the most recent scan date for all ip's?

scan_date field values
03-01
02-22

Tags (3)
0 Karma

Influencer

Use stats command.

your search | stats max(scan_date) as scan_date by field

Sample query:

| makeresults | eval _raw="scan_date IP 
03-01 10.0.0.1
02-22 10.0.0.1
03-04 10.1.1.1
02-20 10.1.1.1" | multikv forceheader=1 | table scan_date, IP | stats max(scan_date) as scan_date by IP
0 Karma