How to use only the latest group of events for each machine to display in the table

[nksiba]

Hello dear Community!

I have a set of separate machines logging number of different events to Splunk, each group can be identified by some unique 'RunId' field. Each machine send event multiple times per day.
Via the some simple 'table' query I can display all collected info on the Dashboard, like

```
index=idx1 sourcetype=machines_monitoring

| table RunId, MachineName, Environment, Version, State

```
Now I have a lot of raws displayed for each machine with the different information about the each machine's state. How can I filter the events to have the table showing only the current state of each machine, without duplicates, using only the latest group of events sent by each machine?
I've tried 'latest(RunId) by RunId, MachineName, Environment, Version, State` with no changes, all duplicated values are displayed as usual.

[nksiba]

Thanks a lot!

[livehybrid · Accepted solution]

Hi @nksiba 

To display only the current state of each machine without duplicates, you need to filter the events to show only the latest event for each machine. You can achieve this by using the stats command to group the events by MachineName (and any other relevant fields) and then use the latest function to get the most recent event for each group. Here's how you can modify your query:

index=idx1 sourcetype=machines_monitoring
| stats latest(RunId) as RunId, latest(State) as State, latest(Environment) as Environment, latest(Version) as Version by MachineName
| table RunId, MachineName, Environment, Version, State

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will