CODEWITHSUNDEEP
splunksplunk-query
D159
D159

Reputation: 311

stats latest not showing any value for field

We have following query -

index=yyy sourcetype=zzz "RAISE_ALERT" logger="aaa" | table uuid message timestamp | eval state="alert" | append [SEARCH index=yyy sourcetype=zzz "CLEAR_ALERT" logger="aaa" | table uuid message timestamp | eval state="no_alert" ] | stats latest(state) as state by uuid

But this query is not showing anything for state, it shows only uuid.

enter image description here

Query before and without latest works just fine. Here is screenshot of result of everything before stats -

enter image description here

If we replace stats latest with stats first, we can see uuid and state, its just not the latest observed value of state for that uuid.

Any idea as to why this can happen?

Upvotes: 0

Views: 368

Answers (1)

D159
D159

Reputation: 311

Looks like table clause was the issue. Removing both table clauses makes this work.

Upvotes: 1

Related Questions