I'm very new to Splunk and searched a lot for this but i wasn't able to figure it out. I have events like name=x, id=n, status=open After resolving each issue, a new event is indexed like name=x, id=n, status=resolved with same name and id (there is only 2 versions of each ID at most) There is a table to show all of events with a filter box as all/open/resolved. Currently I'm using this search to show events and it works fine, unless what is needed is when there is a new event for same id with status=resolved it should not be shown under filter:open . I really have no idea what should i do for this kind of condition so any help would be great. source="issue_log" status=$filter_by$ | rename id as ID, time as "Generate Time", name as Name | table "Alert", ID, "Generate Time", Status | dedup 1 ID ... View more