Hi I have a vast data set with a sample as below. Need to group the data based on three columns latest timestamp data and get the fourth column value against the latest timestamp found for that grouped data. Deployed_Data_time env app version 4/16/2024 15:29 axe1 app1 v-228 4/16/2024 15:29 axe1 app1 v-228 9/15/2023 8:12 axe1 app1 v-131 9/15/2023 8:05 axe2 app1 v-120 9/12/2023 1:19 axe2 app1  v-128 4/16/2024 15:29 axe2 app2 v-628 4/16/2024 15:26 axe2 app2 v-626 9/15/2023 8:12 axe2 app2 v-531 9/15/2023 8:05 axe1 app2 v-530 9/12/2023 1:19 axe1 app2  v-528   and I need the output as  app axe1 axe2 app1 v-228 v-120 app2 v-530 v-628   And I tried something as below but output is not as expected.   index=*.log source=*Report* | eval latestDeployed_version=Deployed_Data_time."|".version | eval latestVersion=Deployed_Data_time."|".version | stats latest(Deployed_Data_time) AS Deployed_Data_time values(env) AS env max(latestVersion) AS latestVersion BY app | rex field=latestVersion "[\|]+(?<version>.*)" | table app,version,env | chart values(version) by app, env limit=0 | fillnull value="Not Deployed"    Please help me achieve this . Thanks  ... View more

hi  I need some thing like the following one as the final output I have tried some thing like this...but not the one i expected...     ....query | chart values(percent) over svc by ResponseCode     is it possible to include something like this, checked and its not working...     ....query | chart values(percent) over Channel,svc by ResponseCode       Thanks ... View more

Hi, I wish to pass the values of $click.value$ and corresponding cell's header (dynamically generated in splunk query) values to the search query in creating the drilldown view of dashboard. Please let me know how to achieve that. for example if the user clicks on the cell containing 100.00 value, I need to pass the channel name adp and header value of 304 to the search query  adp can be achieved through $click.value$ , don't know for 304 (and its corresponding search field name)  ... View more