Splunk Search

stats unique value by latest time

neophyte
Engager

Hi,

I have ticketing system values in my siem, where different support people working on the ticket. I am trying to create a table where I need to show a table of tickets with the last status only per ticket, for example, if 3 engineers worked on a ticket then this table should show the last updated time and status only. my problem is that the following query is grouping tickets correctly but showing all status values per ticket and also changed the _time format to the integer values

 

 

 

| table_time status service user eventid tickets
| stats values(status) values(service) values(user) values(eventid) by tickets
| convert ctime(_time) sort _time

 

 

 

 can you please advise, Regards

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The query is showing all values because you told it to.  To see only the latest values use the latest() function.

| table_time status service user eventid tickets
| stats latest(_time) as _time, latest(status) as status, latest(service) as service, latest(user) as user, latest(eventid) as eventid by tickets
---
If this reply helps you, Karma would be appreciated.

View solution in original post

neophyte
Engager

Many Thanks. this worked like a charm.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The query is showing all values because you told it to.  To see only the latest values use the latest() function.

| table_time status service user eventid tickets
| stats latest(_time) as _time, latest(status) as status, latest(service) as service, latest(user) as user, latest(eventid) as eventid by tickets
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...