Splunk Search

get the latest value in an array

garumaru
Explorer

Hi Guys,

I am working on searching data from Servicenow ticket, and tickets normally have some status for example:

#Ticket     #Status   #Time

Ticket1       Open        Sep 01

Ticket1       Closed     Sep 02

Ticket2        Open        Sep 01

Ticket2        Pending   Sep 03

 

How can I get a table only list the latest status like below:

#Ticket     #Status   #Time

Ticket1       Closed     Sep 02

Ticket2        Pending   Sep 03

 

Thank you!

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust
| stats latest(Status) as Status latest(_time) as _time by Ticekt
————————————
If this helps, give a like below.

View solution in original post

garumaru
Explorer

Thanks @thambisetty , I was using table but didn't think using stats.

0 Karma

thambisetty
SplunkTrust
SplunkTrust
| stats latest(Status) as Status latest(_time) as _time by Ticekt
————————————
If this helps, give a like below.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...