date reportid notificationid status 10/1/2020 5555 1 clear 10/1/2020 2222 2 ...
See more...
date reportid notificationid status 10/1/2020 5555 1 clear 10/1/2020 2222 2 clear 10/2/2020 3333 3 critical 10/3/2020 5555 4 major 10/4/2020 2222 5 critical 10/4/2020 5555 4 clear i would like to display the latest Status by Date based on the REPORT ID (unique id only displays). output: date reportid notificationid status 10/2/2020 3333 3 critical 10/4/2020 2222 5 critical 10/4/2020 5555 4 clear but after the output is displayed, i would like to also now filter/display based on a status. example, based on the initial result, i want to only show if the status = CLEAR output: date reportid notificationid status 10/4/2020 5555 4 clear but i keep getting stuck.. here is my current search that is able to get the initial output. but i dont know how to then filter it further based on intial results. all my searche dont work. index=companyx sourcetype=alarm_status | eval Start=strftime(Start/1000, "%H:%M:%S %d-%b-%Y") |rex field=AlarmPath "^\/(?<AlarmPath1>.+?)\/(?<AlarmPath2>.*)\s\(" |dedup reportid |search AlarmPath1="$field2$" | stats Last(reportid) as ReportId, last(status) as status, last(AlarmPath1) as AlarmPath1, last(AlarmPath2) as AlarmPath2, last(Start) as "Start Time" , by notificationId | sort -notificationId