I have events like these (just some made-up data), that are pushed in JSON format to Splunk:
{"name":"abc", "grade":"third", "result": "PASS", "courses":["math","science","literature"], "interests":["this","that"]}
Events are being generated all the time, and I need to get the latest values of "result", "courses" and "interests" for a given "name" and "grade". Note that "courses" and "interests" are lists/arrays, while other fields are strings.
So I am doing somethings like:
index=whatever name=abc grade=third | stats latest(courses) as courses, latest(interests) as interests, latest(result) as result
index=whatever name=abc grade=third | stats latest(courses{}) as courses, latest(interests{}) as interests, latest(result) as result
index=whatever name=abc grade=third | eval courses=json_array_to_mv(courses), interests=json_array_to_mv(interests) | stats latest(courses) as courses, latest(interests) as interests, latest(result) as result
Also tried with "tstats" approach.
None of those work. I get the courses and interests as empty values. result comes in fine, because its a string.
How can I get the "latest" lists of courses and interests given other values?
... View more