Hey @SN1, What @PickleRick said is correct. You'll be receiving the latest result only since you're using dedup. However, since it is an expensive command, you can use transforming command like stat...
See more...
Hey @SN1, What @PickleRick said is correct. You'll be receiving the latest result only since you're using dedup. However, since it is an expensive command, you can use transforming command like stats as well to fetch the latest results. Your query should look something like below: index=endpoint_defender source="AdvancedHunting-DeviceInfo"
| search (DeviceType=Workstation OR DeviceType= Server) AND DeviceName="bie-n1690.emea.duerr.int"
| search SensorHealthState = "active" OR SensorHealthState = "Inactive" OR SensorHealthState = "Misconfigured" OR SensorHealthState = "Impaired communications" OR SensorHealthState = "No sensor data"
| rex field=DeviceDynamicTags "\"(?<code>(?!/LINUX)[A-Z]+)\""
| rex field=Timestamp "(?<timeval>\d{4}-\d{2}-\d{2})"
| rex field=DeviceName "^(?<Hostname>[^.]+)"
| rename code as 3-Letter-Code
| lookup lkp-GlobalIpRange.csv 3-Letter-Code OUTPUTNEW "Company Code"
| lookup lkp-GlobalIpRange.csv 3-Letter-Code OUTPUT "Company Code" as 4LetCode
| lookup lkp-GlobalIpRange.csv 3-Letter-Code OUTPUT Region as Region
| eval Region=mvindex('Region',0) , "4LetCode"=mvindex('4LetCode',0)
| rename "3-Letter-Code" as CC
| stats latest(SensorHealthState) as latest_SensorHealthState by DeviceName Region ... The latest function will always fetch the latest value of the field passed as an argument on the basis of time. You can add the fields that you want to group the results in the by clause. Hope this helps you optimize your query. Thanks, Tejas. --- If the above solution helps, an upvote is appreciated..!!