Multiple "latest' statements on one table

[tmarlette]

I am attempting to get the latest status of a port scan for 5 different ports per host into a table.

I am trying to format it as follows:

time,host,hostname,port1,port2,port3,port4,port5

Currently, my search string looks like this:
(sourcetype=port_scan dst_port=443 | stats latest(dst_port_state) AS "port 443 state") OR (sourcetype=port_scan dst_port=80 | stats latest(dst_port_state) AS "port 80 state") and so on, but I am getting errors when running this search.

Any assistance would be greatly appreciated!

[yannK · Accepted solution]

once you added your first "|" you cannot add further conditions. the parenthesis can only be used to group conditions not part of the search.
What you are trying to do is building subsearches ( using square brackets)

But in your case, it seems that the best solution is to use grouping per stats.

sourcetype=port_scan (dst_port=443 OR dst_port=80 ) | stats last(dst_port_state) AS "state" by dst_port

and remember that "last" means the oldest events. and "first" means the most recent events.
see http://answers.splunk.com/answers/42570/why-stats-last-and-first-are-inverted
To avoid confusion, you may want to use "earliest".
see http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/CommonStatsFunctions