How to work on the latest event only?

[zacksoft]

I have my query ready which essentially extracts some fields and displays in a table.
But I want to work on the latest event only.
How do I put condition so that my query only works on the latest one event?

[harishalipaka]

|sort _time |head 1

[zacksoft]

Is |sort _time necessary ?
Won't |head 1 alone will do the job?
Just confirming.

[harishalipaka]

If it is realtime data it will come updated with head 1 ..or it is saved data it will directly give top of the value head 1 in this situation you have to sort _time than you will get top value as updated.

[493669]

even if there are duplicates, using head 1 it will took latest one

[harishalipaka]

below example explain how it is works .

| makeresults 
| eval A=45 
| eval DateHour="2018-06-06 18:47:22.820" 
| append 
    [| makeresults 
| eval A=30 
| eval DateHour="2018-06-06 18:45:22.820" ] 
| append 
    [| makeresults 
| eval A=50 
| eval DateHour="2018-06-06 18:57:22.000" ]  
| fields - _time
| head 1

[493669 · Accepted solution]

try head command:
Returns the first N number of specified results in search order

... | head 1