Retrieve all latest rows that share the same _time value?

[HappyFeet]

I have an application that sends logs to Splunk every few seconds. These logs are "snapshots" which provide a static view of the system at the time they were taken/sent to Splunk.

I am attempting to get the latest rows from Splunk and present them in a table. Latest rows are determined by _time.

In the example below I want to retrieve the two last rows because they have the highest _time value.

Any help would be appreciated.

_time	Name	Status
9/28/22 8:14:08.968 PM	SPID 1	Queued
9/28/22 8:14:08.968 PM	SPID 2	Started
9/28/22 8:14:08.968 PM	SPID 3	Failing
9/28/22 8:14:12.968 PM	SPID 1	Started
9/28/22 8:14:12.968 PM	SPID 2	Started

[richgalloway · Accepted solution]

There may be several ways to do that, but here's the first one I thought of.

<<your current search>>
| eventstats max(_time) as max_time
| where _time=max_time

[HappyFeet]

I tried doing something similar with eventstats by counting the number events and grouping by _time to return all events that share the same count but it was not working as I wanted it to.

Thank you. That's surprisingly simple