Single value from multiple values

[renuka]

renuka_0-1596095140908.png

In my data i am getting multiple dates for single id.i need only recent date for each date.how can i remove other dates.please refer screenshot

Thank you in advance

renuka

[bowesmana · Accepted solution]

I can't see your field names, but I am assuming you are getting your results from a search terminating with something like 

| stats values(date) as dates by id

you should use

| stats latest(date) as date by id

but without seeing your search I can't give you a better response

Hope this points you in the right direction

[renuka]

Thank you so much

Stats latest(date) as date by id is giving the values what i need

[renuka]

renuka_0-1596095776632.png

 Thank you for reply,this is my search command and fields

[bowesmana]

You may need to check that the Splunk _time field actually equates to the TC_D2_Execution_Date. If not, then you will need to to it slightly differently, by looking for the largest date, i.e. 

| eval t=strptime(TC_D2_Execution_Date, "%a %d %b %Y %H:%M:%S")
| stats max(t) as Date by "CRS_Customer Requirement Identifier"
| eval Date=strftime(Date, "%a %d %b %Y %H:%M:%S")