Splunk Search

get the latest value in an array

garumaru
Explorer

Hi Guys,

I am working on searching data from Servicenow ticket, and tickets normally have some status for example:

#Ticket     #Status   #Time

Ticket1       Open        Sep 01

Ticket1       Closed     Sep 02

Ticket2        Open        Sep 01

Ticket2        Pending   Sep 03

 

How can I get a table only list the latest status like below:

#Ticket     #Status   #Time

Ticket1       Closed     Sep 02

Ticket2        Pending   Sep 03

 

Thank you!

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust
| stats latest(Status) as Status latest(_time) as _time by Ticekt
————————————
If this helps, give a like below.

View solution in original post

garumaru
Explorer

Thanks @thambisetty , I was using table but didn't think using stats.

0 Karma

thambisetty
SplunkTrust
SplunkTrust
| stats latest(Status) as Status latest(_time) as _time by Ticekt
————————————
If this helps, give a like below.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...