How would I count by a most recent event value?

[splunkingjh]

The value that I need to count can be in multiple events. I just want to count it one time, but it will need to be the most recent value counted.

[sundareshr]

Try this, assuming the values are extracted in a field called yourField

index=foo sourcetype=bar | stats dc(yourField) as yourField by facility

*OR*

index=foo sourcetype=bar | timechart span=1h latest(yourField) as yourField by facility

[somesoni2]

Without much information, I would suggest to give these a try

index=foo sourcetype=bar yourfield=yourvalue | head 1 | table yourfield

index=foo sourcetype=bar | stats latest(yourfield) as yourfield

[splunkingjh]

The second option seems to pull back the most recent. Is there a way that I can count all of those values? I am trying to parse HL7 data. It has presented quite the challenge. I am trying to provide a visual that will show active counts across the facility of different events.

[somesoni2]

By "Is there a way that I can count all of those values", Do you mean that you want to count the event which has the same value for field yourfield as in the latest event? If yes, then try something like this (if no, provide more info)

index=foo sourcetype=bar [ search index=foo sourcetype=bar | stats latest(yourfield) as yourfield] | stats count by yourfield