How to select one event from a transaction?

[juanpavergara]

I need to group the events (in this case by JSESSIONID) and select the one with the max date

I have the groups with the following query:

date_month="march" date_mday>="25" date_mday<="26" | transaction JSESSIONID

How can I get every transaction only with the newest event?

TKS!

[niketn]

@juanpavergara... do you need only one event for each JSESSIONID with only the latest event(or you need correlated events as well with time of transaction as latest time?)
Instead of transaction you should try dedup command, as transaction will be very expensive command specially when you do not need correlated event rather just the latest event. Since latest data is fetched first, dedup will get only the latest match for each JSESSIONID

date_month="march" date_mday>="25" date_mday<="26" 
| dedup JSESSIONID
| table _time JSESSIONID _raw

Instead of _raw you can select specific fields you need.

[koshyk]

hi
can u please try

date_month="march" date_mday>="25" date_mday<="26" | transaction JSESSIONID | stats latest(JSESSIONID)

may be you can try any of the option try to fit whichever best

first(JSESSIONID)
latest(JSESSIONID)
last(JSESSIONID)
earliest(JSESSIONID)