Splunk Search

print latest and values of status in an order.

Contributor

I have some this like this

|stats value(status) by time, id

I want to print the latest time, values(status) in the order they got indexed or they happened by id.

Can someone help, Thanks!

0 Karma

Esteemed Legend

If you use the values() aggregation function, it will sort them alphabetically but if you use the list() aggregation function, it will preserve the order of the events at the point you called stats.

Motivator

Greetings @sandeepmakkena,

Please expand more. Based on what little you've provided, try this:

|stats value(status) latest(_indextime) as _indextime latest(_time) as _time by time, id
| convert ctime(_indextime) as indextime
| convert ctime(_time) as _time

Cheers,
Jacob

Cheers,
Jacob
0 Karma

Contributor

Values(status) are printing in alphabetical order, I want them to be in the order of they occurred.

0 Karma

Motivator
 | stats value(status) as statuses latest(_time) as _time by id
 | sort _time

You haven't provided enough information for us to help you. Can you provide a snippet of censored data and what you'd like the output to look like?

Cheers,
Jacob
0 Karma

Contributor

What you are saying will sort all the results but, not the status from values(status) output.

0 Karma

Motivator

See @woodcock 's answer

Cheers,
Jacob