Answer by warren for Splunk: How to get N-most-recent values for each group?

While @RichG’s dedup option may work, here’s one that uses stats and mvindex:

index=ndx sourcetype=srctp clientType=* key=*
| eval comb=_time+" | "+key
| stats values(comb) as comb by clientType
| eval mostrecents=mvindex(comb,-N,-1)
| fields - comb
| mvexpand mostrecents
| rex field=mostrecent "(?<timemost>\d+)\s\|\s(?<keymost>.+)"
| table clientType timemost keymost
| eval timemost=strftime(timemost,"%c")

from User warren – Stack Overflow https://stackoverflow.com/questions/64336226/splunk-how-to-get-n-most-recent-values-for-each-group/64340338#64340338
via IFTTT