How to group by latest date?

[designer46]

Hi,

See, I have been trying to group my result query based on the latest date in order to remove duplicates and get the most recent one.

This is an example of what I have:

Field1	Field2	Date
AAA	111	21 Jan 2021
AAA	111	22 Jan 2021
BBB	332	20 Jan 2021
BBB	552	22 Jan 2021

And what I would want to have:

Field1	Field2	Date
AAA	111	22 Jan 2021
BBB	332	20 Jan 2021
BBB	552	22 Jan 2021

I would really appreciate the help.

Thanks

[saravanan90 · Accepted solution]

This may help..

| makeresults | eval _raw="Field1,Field2,Date
AAA,111,21 Jan 2021
AAA,111,22 Jan 2021
BBB,332,20 Jan 2021
BBB,552,24 Jan 2021" | multikv forceheader=1 | eval Date1=strptime(Date,"%d %b %Y") | eventstats max(Date) as maximum by Field1 | where maximum=Date | fields - maximum,Date1

[designer46]

Thanks! Works like a charm!