Search query to find latest state of incident(ticket) of SNOW

[AbdulMateen]

Requirement- i am trying to create a report based on State of Incident( ticket).  looking for latest State of ticket
below is the my search query.  if time range is selected more then "Today". results showing the previous Ticket State as well.  ex Tkt123 current State is Resolved , prior to  resolved State it was "IN PROGRESS".  expected result should show current State of Tkt123 .

In below query i am looking for "IN PROGRESS" ticket State in Q_name=IT . but it is showing Tkt123 as well.  when checked Tkt123  in SNOW tool it is resolved status

index=SNOW source=SNOW_source Q_name=IT
|stats latest(State) AS State BY Number Last_Updated
| stats dc(Number) AS Total
|search State="IN PROGRESS"
|appendpipe [stats count| eval Total="NODATA" |where count==0|table Total]

@ITWhisperer 

[SanjayReddy]

Hi @AbdulMateen 

in your logs if date field presents , you can also run 

| stats max(date) 

it will show latest event for the ticket 

[johnhua]

If the most current result represents the most current state, you can simply dedup your data by ticket_id. 

Assuming "Number" is the ticket_id, you can try:

index=SNOW source=SNOW_source Q_name=IT
| dedup Number