@SN1 You can sort _time and dedup device or you can use stats last() also, Eg: index=endpoint_defender source="AdvancedHunting-DeviceInfo"
DeviceType=Workstation OR DeviceType=Server
SensorHealth...
See more...
@SN1 You can sort _time and dedup device or you can use stats last() also, Eg: index=endpoint_defender source="AdvancedHunting-DeviceInfo"
DeviceType=Workstation OR DeviceType=Server
SensorHealthState IN ("active", "Inactive", "Misconfigured", "Impaired communications", "No sensor data")
DeviceName="bie-n1690.emea.duerr.int"
| sort 0 - _time
| dedup DeviceName
| rex field=DeviceDynamicTags "\"(?<code>(?!/LINUX)[A-Z]+)\""
| rex field=Timestamp "(?<timeval>\d{4}-\d{2}-\d{2})"
| rex field=DeviceName "^(?<Hostname>[^.]+)"
| rename code as 3-Letter-Code
| lookup lkp-GlobalIpRange.csv 3-Letter-Code OUTPUTNEW "Company Code"
| lookup lkp-GlobalIpRange.csv 3-Letter-Code OUTPUT "Company Code" as 4LetCode
| lookup lkp-GlobalIpRange.csv 3-Letter-Code OUTPUT Region as Region
| eval Region=mvindex(Region, 0), "4LetCode"=mvindex('4LetCode', 0)
| rename "3-Letter-Code" as CC
| table Hostname CC 4LetCode DeviceName timeval Region SensorHealthState Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!