Splunk Search

Pick latest event

SplunkTrust
SplunkTrust

Hi,
I want only return the latest event

The following seems to work so far. It is correct? No entirely sure what the sort criteria for Top is

Top limit=1 Color,TimeStamp,Bank,DX | table Color

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

No. The "top" command is used to find the most frequent value of the field specified, here you specify 4 fields, so we return the most common combination of these four fields.

You are looking for the "head" command: ... | head 1 | ...

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

No. The "top" command is used to find the most frequent value of the field specified, here you specify 4 fields, so we return the most common combination of these four fields.

You are looking for the "head" command: ... | head 1 | ...

View solution in original post

0 Karma