Splunk Search

latest function in stats not working without earliest?

vbumgarn
Path Finder

Given the events:

2012-03-06 01:02:00 a=1 b=2
2012-03-06 02:03:00 a=2 b=3

and the query:

* | stats count latest(a) by b

latest(a) is empty. However, if you add earliest(a) to the query, like so:

* | stats count latest(a) earliest(a) by b

then both latest(a) and earliest(a) are populated. earliest also works by itself.

Any idea why latest won't work by itself?

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

I filed this as SPL-50131 and I will do my best to update as I have more information.

In the meantime, use the workaround here:

http://splunk-base.splunk.com/answers/45268/stats-latest-not-returning-a-value/45276

View solution in original post

araitz
Splunk Employee
Splunk Employee

I filed this as SPL-50131 and I will do my best to update as I have more information.

In the meantime, use the workaround here:

http://splunk-base.splunk.com/answers/45268/stats-latest-not-returning-a-value/45276

caseypike
Path Finder

I am having the same problem in 6.0.1. Sometimes the latest result is returned, sometimes it is blank.

0 Karma

shreyans
Path Finder

Hi,

See that stats command need _time field to get latest so if you have query like
index=xyz | tabel t1, t2,t3 | stats latest(t1) by t2,t3

then you will see blank for latest(t1) column

change query like
index=xyz | tabel t1, t2, t3,_time | stats latest(t1) by t2,t3 | fields - _time
OR
index=xyz | stats latest(t1) by t2,t3

0 Karma

araitz
Splunk Employee
Splunk Employee

According to SPL-50131 this was fixed in 4.3.3 and also should be fixed in 5.0.0 through 5.0.2. If this isn't the case, please file a support ticket so we can get the required information from you.

0 Karma

srowe
Explorer

Is this supposed to be fixed in 5.0.1? We are having the same issue...what is the workaround?

0 Karma

araitz
Splunk Employee
Splunk Employee

It was always to late for 4.3.2, so I would hope 4.3.3.

0 Karma

vbumgarn
Path Finder

Still broken in 4.3.2. Any idea on when a fix will be in?

0 Karma

bmgilmore
Path Finder

nice catch. I'd been having the hardest time figuring out why latest only worked sometimes, I just started to use first. Seems like a bug to me!

0 Karma

rmonge
New Member

Thanks for posting this question. I was frustrated about last() working but then latest() had no results. I added earliest() and for some reason latest() worked. It looks like a bug to me.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...