date reportid notificationid status
10/1/2020 5555 1 clear
10/1/2020 2222 2 clear
10/2/2020 3333 3 critical
10/3/2020 5555 4 major
10/4/2020 2222 5 critical
10/4/2020 5555 4 clear
i would like to display the latest Status by Date based on the REPORT ID (unique id only displays).
output:
date reportid notificationid status
10/2/2020 3333 3 critical
10/4/2020 2222 5 critical
10/4/2020 5555 4 clear
but after the output is displayed, i would like to also now filter/display based on a status.
example, based on the initial result, i want to only show if the status = CLEAR
output:
date reportid notificationid status
10/4/2020 5555 4 clear
but i keep getting stuck.. here is my current search that is able to get the initial output. but i dont know how to then filter it further based on intial results. all my searche dont work.
index=companyx sourcetype=alarm_status
| eval Start=strftime(Start/1000, "%H:%M:%S %d-%b-%Y")
|rex field=AlarmPath "^\/(?<AlarmPath1>.+?)\/(?<AlarmPath2>.*)\s\("
|dedup reportid
|search AlarmPath1="$field2$"
| stats Last(reportid) as ReportId, last(status) as status, last(AlarmPath1) as AlarmPath1, last(AlarmPath2) as AlarmPath2, last(Start) as "Start Time" , by notificationId
| sort -notificationId
