How to get most recent results based on field value?

[vikram1583]

Hi,

I'm trying to get the results based on recent field value. How to filter the events with the most recent scan date for all ip's?

scan_date field values
03-01
02-22

[manjunathmeti]

Use stats command.

your search | stats max(scan_date) as scan_date by field

Sample query:

| makeresults | eval _raw="scan_date IP 
03-01 10.0.0.1
02-22 10.0.0.1
03-04 10.1.1.1
02-20 10.1.1.1" | multikv forceheader=1 | table scan_date, IP | stats max(scan_date) as scan_date by IP