Try this, assuming the values are extracted in a field called
index=foo sourcetype=bar | stats dc(yourField) as yourField by facility
index=foo sourcetype=bar | timechart span=1h latest(yourField) as yourField by facility
Without much information, I would suggest to give these a try
index=foo sourcetype=bar yourfield=yourvalue | head 1 | table yourfield index=foo sourcetype=bar | stats latest(yourfield) as yourfield
The second option seems to pull back the most recent. Is there a way that I can count all of those values? I am trying to parse HL7 data. It has presented quite the challenge. I am trying to provide a visual that will show active counts across the facility of different events.
By "Is there a way that I can count all of those values", Do you mean that you want to count the event which has the same value for field yourfield as in the latest event? If yes, then try something like this (if no, provide more info)
index=foo sourcetype=bar [ search index=foo sourcetype=bar | stats latest(yourfield) as yourfield] | stats count by yourfield