Splunk Search

How to group by latest date?

designer46
Explorer

Hi,

See, I have been trying to group my result query based on the latest date in order to remove duplicates and get the most recent one.

This is an example of what I have:

Field1Field2Date
AAA11121 Jan 2021
AAA11122 Jan 2021
BBB33220 Jan 2021
BBB55222 Jan 2021

 

And what I would want to have:

Field1Field2Date
AAA11122 Jan 2021
BBB33220 Jan 2021
BBB55222 Jan 2021

 

I would really appreciate the help.

 

Thanks

Labels (2)
0 Karma
1 Solution

saravanan90
Contributor

This may help..

| makeresults | eval _raw="Field1,Field2,Date
AAA,111,21 Jan 2021
AAA,111,22 Jan 2021
BBB,332,20 Jan 2021
BBB,552,24 Jan 2021" | multikv forceheader=1 | eval Date1=strptime(Date,"%d %b %Y") | eventstats max(Date) as maximum by Field1 | where maximum=Date | fields - maximum,Date1

View solution in original post

0 Karma

saravanan90
Contributor

This may help..

| makeresults | eval _raw="Field1,Field2,Date
AAA,111,21 Jan 2021
AAA,111,22 Jan 2021
BBB,332,20 Jan 2021
BBB,552,24 Jan 2021" | multikv forceheader=1 | eval Date1=strptime(Date,"%d %b %Y") | eventstats max(Date) as maximum by Field1 | where maximum=Date | fields - maximum,Date1

View solution in original post

0 Karma

designer46
Explorer

Thanks! Works like a charm!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!