Splunk Search

print latest and values of status in an order.

sandeepmakkena
Contributor

I have some this like this

|stats value(status) by time, id

I want to print the latest time, values(status) in the order they got indexed or they happened by id.

Can someone help, Thanks!

0 Karma

woodcock
Esteemed Legend

If you use the values() aggregation function, it will sort them alphabetically but if you use the list() aggregation function, it will preserve the order of the events at the point you called stats.

jacobpevans
Motivator

Greetings @sandeepmakkena,

Please expand more. Based on what little you've provided, try this:

|stats value(status) latest(_indextime) as _indextime latest(_time) as _time by time, id
| convert ctime(_indextime) as indextime
| convert ctime(_time) as _time

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

sandeepmakkena
Contributor

Values(status) are printing in alphabetical order, I want them to be in the order of they occurred.

0 Karma

jacobpevans
Motivator
 | stats value(status) as statuses latest(_time) as _time by id
 | sort _time

You haven't provided enough information for us to help you. Can you provide a snippet of censored data and what you'd like the output to look like?

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

sandeepmakkena
Contributor

What you are saying will sort all the results but, not the status from values(status) output.

0 Karma

jacobpevans
Motivator

See @woodcock 's answer

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!