latest function in stats not working without earliest?

[vbumgarn]

Given the events:

2012-03-06 01:02:00 a=1 b=2
2012-03-06 02:03:00 a=2 b=3

and the query:

* | stats count latest(a) by b

latest(a) is empty. However, if you add earliest(a) to the query, like so:

* | stats count latest(a) earliest(a) by b

then both latest(a) and earliest(a) are populated. earliest also works by itself.

Any idea why latest won't work by itself?

[araitz · Accepted solution]

I filed this as SPL-50131 and I will do my best to update as I have more information.

In the meantime, use the workaround here:

http://splunk-base.splunk.com/answers/45268/stats-latest-not-returning-a-value/45276

[caseypike]

I am having the same problem in 6.0.1. Sometimes the latest result is returned, sometimes it is blank.

[shreyans]

Hi,

See that stats command need _time field to get latest so if you have query like
index=xyz | tabel t1, t2,t3 | stats latest(t1) by t2,t3

then you will see blank for latest(t1) column

change query like
index=xyz | tabel t1, t2, t3,_time | stats latest(t1) by t2,t3 | fields - _time
OR
index=xyz | stats latest(t1) by t2,t3

[araitz]

According to SPL-50131 this was fixed in 4.3.3 and also should be fixed in 5.0.0 through 5.0.2. If this isn't the case, please file a support ticket so we can get the required information from you.

[srowe]

Is this supposed to be fixed in 5.0.1? We are having the same issue...what is the workaround?

[araitz]

It was always to late for 4.3.2, so I would hope 4.3.3.

[vbumgarn]

Still broken in 4.3.2. Any idea on when a fix will be in?

[bmgilmore]

nice catch. I'd been having the hardest time figuring out why latest only worked sometimes, I just started to use first. Seems like a bug to me!

[rmonge]

Thanks for posting this question. I was frustrated about last() working but then latest() had no results. I added earliest() and for some reason latest() worked. It looks like a bug to me.