how to show most recent value of "status" field for each server by group

[benjamincortega]

With log data as such:

date_time server=server1 group=group1 status=statusA
date_time server=server2 group=group1 status=statusA
date_time server=server3 group=group1 status=statusA
date_time server=server4 group=group1 status=statusA
date_time server=server1 group=group2 status=statusA
date_time server=server2 group=group2 status=statusA
date_time server=server3 group=group2 status=statusA
date_time server=server7 group=group2 status=statusA
date_time server=server1 group=group1 status=statusB
date_time server=server2 group=group1 status=statusB
date_time server=server3 group=group1 status=statusB
date_time server=server1 group=group2 status=statusB
date_time server=server2 group=group2 status=statusB

I’d like to be able to show a table of results that look like this:

group1 server1 statusB
.............server2 statusB
.............server3 statusB
.............server4 statusA
group2 server1 statusB
.............server2 statusB
.............server3 statusA
.............server7 statusA

The table should show all groups that appear in the log, and under each group it should list all servers that are associated with that group along with the most recent status for each of those servers in that particular group.

[sbbadri]

Hi,

Please try this,

.... | eval co = server."". status | stats values(co) as server_status by group | rex field=server_status "(?P\S+)(?P\S+)" | fields - server_status

[adonio]

.... | stats latest(status) by server group