Hi,
See, I have been trying to group my result query based on the latest date in order to remove duplicates and get the most recent one.
This is an example of what I have:
Field1 | Field2 | Date |
AAA | 111 | 21 Jan 2021 |
AAA | 111 | 22 Jan 2021 |
BBB | 332 | 20 Jan 2021 |
BBB | 552 | 22 Jan 2021 |
And what I would want to have:
Field1 | Field2 | Date |
AAA | 111 | 22 Jan 2021 |
BBB | 332 | 20 Jan 2021 |
BBB | 552 | 22 Jan 2021 |
I would really appreciate the help.
Thanks
This may help..
| makeresults | eval _raw="Field1,Field2,Date
AAA,111,21 Jan 2021
AAA,111,22 Jan 2021
BBB,332,20 Jan 2021
BBB,552,24 Jan 2021" | multikv forceheader=1 | eval Date1=strptime(Date,"%d %b %Y") | eventstats max(Date) as maximum by Field1 | where maximum=Date | fields - maximum,Date1
This may help..
| makeresults | eval _raw="Field1,Field2,Date
AAA,111,21 Jan 2021
AAA,111,22 Jan 2021
BBB,332,20 Jan 2021
BBB,552,24 Jan 2021" | multikv forceheader=1 | eval Date1=strptime(Date,"%d %b %Y") | eventstats max(Date) as maximum by Field1 | where maximum=Date | fields - maximum,Date1
Thanks! Works like a charm!