Splunk Search

get the latest value in an array

garumaru
Explorer

Hi Guys,

I am working on searching data from Servicenow ticket, and tickets normally have some status for example:

#Ticket     #Status   #Time

Ticket1       Open        Sep 01

Ticket1       Closed     Sep 02

Ticket2        Open        Sep 01

Ticket2        Pending   Sep 03

 

How can I get a table only list the latest status like below:

#Ticket     #Status   #Time

Ticket1       Closed     Sep 02

Ticket2        Pending   Sep 03

 

Thank you!

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust
| stats latest(Status) as Status latest(_time) as _time by Ticekt
————————————
If this helps, give a like below.

View solution in original post

garumaru
Explorer

Thanks @thambisetty , I was using table but didn't think using stats.

0 Karma

thambisetty
SplunkTrust
SplunkTrust
| stats latest(Status) as Status latest(_time) as _time by Ticekt
————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...