Splunk Search

I want to include field values which have the latest timestamp value for a particular field

bineetadas
New Member

events are like this : number = INCXXXXXX dv_sys = yyyy-mm-dd hh:mm:ss group = lx ........
for a particular value of field number there are multiple events containing various values for the other field dv
_sys

I only want my search results to display the one with the latest timestamp value.

Can anyone help with the correct syntax please?

Tags (1)
0 Karma
1 Solution

aberkow
Builder

To use the latest function of the stats command, you need a _time field. So, for each log, you probably want to create that field with an eval statement, leveraging the strptime command

base search to pull logs in...
| eval _time=strptime(dv_sys, "%Y-%m-%d H:M:S")
| stats latest(number) as latestNumber by _time

You'll likely need to play with the dv_sys strptime extract using the common variables found here: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Commontimeformatvariables, but this should generally get you what you're going for. If you already have a _time field on each log, then you can just ignore the eval command and go straight to the stats.

Does this answer your question?

View solution in original post

0 Karma

aberkow
Builder

To use the latest function of the stats command, you need a _time field. So, for each log, you probably want to create that field with an eval statement, leveraging the strptime command

base search to pull logs in...
| eval _time=strptime(dv_sys, "%Y-%m-%d H:M:S")
| stats latest(number) as latestNumber by _time

You'll likely need to play with the dv_sys strptime extract using the common variables found here: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Commontimeformatvariables, but this should generally get you what you're going for. If you already have a _time field on each log, then you can just ignore the eval command and go straight to the stats.

Does this answer your question?

0 Karma

arjunpkishore5
Motivator

i would guess number is your id field. In your example, it looks like it's a bmc incident number.

you can do this |stats latest(*) as * by < id fields >

in your case, |stats latest(*) as * by number

This works only if the _time values are different. I would suggest using a filed like "Last Modified timestamp" for _time

Please mark as answer if this answers your query

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...