Splunk Search

latest function in stats not working without earliest?

vbumgarn
Path Finder

Given the events:

2012-03-06 01:02:00 a=1 b=2
2012-03-06 02:03:00 a=2 b=3

and the query:

* | stats count latest(a) by b

latest(a) is empty. However, if you add earliest(a) to the query, like so:

* | stats count latest(a) earliest(a) by b

then both latest(a) and earliest(a) are populated. earliest also works by itself.

Any idea why latest won't work by itself?

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

I filed this as SPL-50131 and I will do my best to update as I have more information.

In the meantime, use the workaround here:

http://splunk-base.splunk.com/answers/45268/stats-latest-not-returning-a-value/45276

View solution in original post

araitz
Splunk Employee
Splunk Employee

I filed this as SPL-50131 and I will do my best to update as I have more information.

In the meantime, use the workaround here:

http://splunk-base.splunk.com/answers/45268/stats-latest-not-returning-a-value/45276

caseypike
Path Finder

I am having the same problem in 6.0.1. Sometimes the latest result is returned, sometimes it is blank.

0 Karma

shreyans
Path Finder

Hi,

See that stats command need _time field to get latest so if you have query like
index=xyz | tabel t1, t2,t3 | stats latest(t1) by t2,t3

then you will see blank for latest(t1) column

change query like
index=xyz | tabel t1, t2, t3,_time | stats latest(t1) by t2,t3 | fields - _time
OR
index=xyz | stats latest(t1) by t2,t3

0 Karma

araitz
Splunk Employee
Splunk Employee

According to SPL-50131 this was fixed in 4.3.3 and also should be fixed in 5.0.0 through 5.0.2. If this isn't the case, please file a support ticket so we can get the required information from you.

0 Karma

srowe
Explorer

Is this supposed to be fixed in 5.0.1? We are having the same issue...what is the workaround?

0 Karma

araitz
Splunk Employee
Splunk Employee

It was always to late for 4.3.2, so I would hope 4.3.3.

0 Karma

vbumgarn
Path Finder

Still broken in 4.3.2. Any idea on when a fix will be in?

0 Karma

bmgilmore
Path Finder

nice catch. I'd been having the hardest time figuring out why latest only worked sometimes, I just started to use first. Seems like a bug to me!

0 Karma

rmonge
New Member

Thanks for posting this question. I was frustrated about last() working but then latest() had no results. I added earliest() and for some reason latest() worked. It looks like a bug to me.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...