Splunk Search

How to get most recent results based on field value?

vikram1583
Explorer

Hi,

I'm trying to get the results based on recent field value. How to filter the events with the most recent scan date for all ip's?

scan_date field values
03-01
02-22

Tags (3)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Use stats command.

your search | stats max(scan_date) as scan_date by field

Sample query:

| makeresults | eval _raw="scan_date IP 
03-01 10.0.0.1
02-22 10.0.0.1
03-04 10.1.1.1
02-20 10.1.1.1" | multikv forceheader=1 | table scan_date, IP | stats max(scan_date) as scan_date by IP
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...