I'm trying to get the results based on recent field value. How to filter the events with the most recent scan date for all ip's?
scan_date field values
Use stats command.
your search | stats max(scan_date) as scan_date by field
| makeresults | eval _raw="scan_date IP
02-20 10.1.1.1" | multikv forceheader=1 | table scan_date, IP | stats max(scan_date) as scan_date by IP