Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to work on the latest event only?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have my query ready which essentially extracts some fields and displays in a table.
But I want to work on the latest event only.
How do I put condition so that my query only works on the latest one event?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try head command:
Returns the first N number of specified results in search order
... | head 1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
|sort _time |head 1
Harish
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is |sort _time necessary ?
Won't |head 1 alone will do the job?
Just confirming.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If it is realtime data it will come updated with head 1 ..or it is saved data it will directly give top of the value head 1 in this situation you have to sort _time than you will get top value as updated.
Harish
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
even if there are duplicates, using head 1 it will took latest one
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
below example explain how it is works .
| makeresults
| eval A=45
| eval DateHour="2018-06-06 18:47:22.820"
| append
[| makeresults
| eval A=30
| eval DateHour="2018-06-06 18:45:22.820" ]
| append
[| makeresults
| eval A=50
| eval DateHour="2018-06-06 18:57:22.000" ]
| fields - _time
| head 1
Harish
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try head command:
Returns the first N number of specified results in search order
... | head 1
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
