Solved: Re: How to group by latest date? - Splunk Community

Splunk Search

Hi,

See, I have been trying to group my result query based on the latest date in order to remove duplicates and get the most recent one.

This is an example of what I have:

Field1	Field2	Date
AAA	111	21 Jan 2021
AAA	111	22 Jan 2021
BBB	332	20 Jan 2021
BBB	552	22 Jan 2021

And what I would want to have:

Field1	Field2	Date
AAA	111	22 Jan 2021
BBB	332	20 Jan 2021
BBB	552	22 Jan 2021

I would really appreciate the help.

Thanks

1 Solution

Solution

This may help..

| makeresults | eval _raw="Field1,Field2,Date
AAA,111,21 Jan 2021
AAA,111,22 Jan 2021
BBB,332,20 Jan 2021
BBB,552,24 Jan 2021" | multikv forceheader=1 | eval Date1=strptime(Date,"%d %b %Y") | eventstats max(Date) as maximum by Field1 | where maximum=Date | fields - maximum,Date1

View solution in original post

Solution

This may help..

| makeresults | eval _raw="Field1,Field2,Date
AAA,111,21 Jan 2021
AAA,111,22 Jan 2021
BBB,332,20 Jan 2021
BBB,552,24 Jan 2021" | multikv forceheader=1 | eval Date1=strptime(Date,"%d %b %Y") | eventstats max(Date) as maximum by Field1 | where maximum=Date | fields - maximum,Date1

Thanks! Works like a charm!

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...