Splunk Search

latest function in stats not working without earliest?

vbumgarn
Path Finder

Given the events:

2012-03-06 01:02:00 a=1 b=2
2012-03-06 02:03:00 a=2 b=3

and the query:

* | stats count latest(a) by b

latest(a) is empty. However, if you add earliest(a) to the query, like so:

* | stats count latest(a) earliest(a) by b

then both latest(a) and earliest(a) are populated. earliest also works by itself.

Any idea why latest won't work by itself?

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

I filed this as SPL-50131 and I will do my best to update as I have more information.

In the meantime, use the workaround here:

http://splunk-base.splunk.com/answers/45268/stats-latest-not-returning-a-value/45276

View solution in original post

araitz
Splunk Employee
Splunk Employee

I filed this as SPL-50131 and I will do my best to update as I have more information.

In the meantime, use the workaround here:

http://splunk-base.splunk.com/answers/45268/stats-latest-not-returning-a-value/45276

View solution in original post

caseypike
Path Finder

I am having the same problem in 6.0.1. Sometimes the latest result is returned, sometimes it is blank.

0 Karma

shreyans
Path Finder

Hi,

See that stats command need _time field to get latest so if you have query like
index=xyz | tabel t1, t2,t3 | stats latest(t1) by t2,t3

then you will see blank for latest(t1) column

change query like
index=xyz | tabel t1, t2, t3,_time | stats latest(t1) by t2,t3 | fields - _time
OR
index=xyz | stats latest(t1) by t2,t3

0 Karma

araitz
Splunk Employee
Splunk Employee

According to SPL-50131 this was fixed in 4.3.3 and also should be fixed in 5.0.0 through 5.0.2. If this isn't the case, please file a support ticket so we can get the required information from you.

0 Karma

srowe
Explorer

Is this supposed to be fixed in 5.0.1? We are having the same issue...what is the workaround?

0 Karma

araitz
Splunk Employee
Splunk Employee

It was always to late for 4.3.2, so I would hope 4.3.3.

0 Karma

vbumgarn
Path Finder

Still broken in 4.3.2. Any idea on when a fix will be in?

0 Karma

bmgilmore
Path Finder

nice catch. I'd been having the hardest time figuring out why latest only worked sometimes, I just started to use first. Seems like a bug to me!

0 Karma

rmonge
New Member

Thanks for posting this question. I was frustrated about last() working but then latest() had no results. I added earliest() and for some reason latest() worked. It looks like a bug to me.

0 Karma