Splunk Search

Last record per hour

627412
New Member

I manage to extract the data from Splunk below:
ID SignalStrength TimeStamp
01 3 09:00:05
01 0 09:30:00
02 0 09:00:05
02 0 09:30:00
02 3 09:55:00

But I wanted to reduce it further to only get the last record in the hour, like this:
ID SignalStrength TimeStamp
01 0 09:30:00
02 3 09:55:00

I tried this:
| stats max(Timestamp) by ID, SignalStrength

but it gave me the maximum on the day not per hour.

Tags (1)
0 Karma

manjunathmeti
Champion

Try this:

| bin _time span=1h | stats max(Timestamp) by ID, SignalStrength, _time
0 Karma
Get Updates on the Splunk Community!

See Splunk Platform & Observability Innovations at Cisco Live EMEA

Hi Splunkers, Learn about what’s next for Splunk Platform at Cisco Live EMEA.  Data silos are a big challenge ...

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...