Splunk Search

Why is Splunk gathering latest data even with Null values?

Builder

How can i get latest value of all ID (1-1,1-2,2-1,2-2). considering there are no latest data on ID(2-1,2-2)

Data:

12:10:01 ID 1-1, value="GOOD"
12:10:01 ID 1-2, value="GOOD"
12:10:02 ID 2-1, value="GOOD"
12:10:02 ID 2-2, value="GOOD"

12:10:03 ID 1-1, value="GOOD"
12:10:03 ID 1-2, value="GOOD"
12:10:04 ID 2-1, value="GOOD"
12:10:04 ID 2-2, value="GOOD"

12:10:05 ID 1-1, value="GOOD"
12:10:05 ID 1-2, value="GOOD"
12:10:06 ID 2-1, value="GOOD"
12:10:06 ID 2-2, value="GOOD"

12:10:07 ID 1-1, value="GOOD"
12:10:07 ID 1-2, value="GOOD"

12:10:08 ID 1-1, value="GOOD"
12:10:08 ID 1-2, value="GOOD"

alt text

0 Karma

New Member

I'm assuming your fields are extracted properly, so that "ID" and "value" are both extracted. You can retrieve the last value for each ID using the stats command latest:

[Your search string to find the events] | stats latest(value) by ID

This will give you a table of IDs and the latest value field for each. You can read more about stats here:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats

0 Karma