Splunk Search

How would I count by a most recent event value?

splunkingjh
Engager

The value that I need to count can be in multiple events. I just want to count it one time, but it will need to be the most recent value counted.

0 Karma

sundareshr
Legend

Try this, assuming the values are extracted in a field called yourField

index=foo sourcetype=bar | stats dc(yourField) as yourField by facility

*OR*

index=foo sourcetype=bar | timechart span=1h latest(yourField) as yourField by facility

somesoni2
SplunkTrust
SplunkTrust

Without much information, I would suggest to give these a try

index=foo sourcetype=bar yourfield=yourvalue | head 1 | table yourfield

index=foo sourcetype=bar | stats latest(yourfield) as yourfield

splunkingjh
Engager

The second option seems to pull back the most recent. Is there a way that I can count all of those values? I am trying to parse HL7 data. It has presented quite the challenge. I am trying to provide a visual that will show active counts across the facility of different events.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

By "Is there a way that I can count all of those values", Do you mean that you want to count the event which has the same value for field yourfield as in the latest event? If yes, then try something like this (if no, provide more info)

index=foo sourcetype=bar [ search index=foo sourcetype=bar | stats latest(yourfield) as yourfield] | stats count by yourfield
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...