https://community.splunk.com/t5/Getting-Data-In/query-for-searching-passive-hosts/m-p/207606#M40922 <P>That query is not valid. I believe the correct version would be</P> <PRE><CODE>| metadata type=hosts | sort -recentTime | convert ctime(recentTime) as Latest_Time </CODE></PRE> <P>which retrieves a list of host names from the default indexes, sorts them from most-recently used to least-recently used, then converts the recentTime field from epoch format into text and renames it to Latest_Time.</P> Wed, 28 Dec 2016 20:28:06 GMT richgalloway 2016-12-28T20:28:06Z https://community.splunk.com/t5/Getting-Data-In/query-for-searching-passive-hosts/m-p/207605#M40921 <P>Can someone please explain me what does the following query will do step by step ?</P> <PRE><CODE> type=hosts | sort -recentTime | convert ctime(recentTime) as Latest_Time </CODE></PRE> <P>thank you</P> Wed, 28 Dec 2016 20:05:54 GMT https://community.splunk.com/t5/Getting-Data-In/query-for-searching-passive-hosts/m-p/207605#M40921 kteng2024 2016-12-28T20:05:54Z https://community.splunk.com/t5/Getting-Data-In/query-for-searching-passive-hosts/m-p/207606#M40922 <P>That query is not valid. I believe the correct version would be</P> <PRE><CODE>| metadata type=hosts | sort -recentTime | convert ctime(recentTime) as Latest_Time </CODE></PRE> <P>which retrieves a list of host names from the default indexes, sorts them from most-recently used to least-recently used, then converts the recentTime field from epoch format into text and renames it to Latest_Time.</P> Wed, 28 Dec 2016 20:28:06 GMT https://community.splunk.com/t5/Getting-Data-In/query-for-searching-passive-hosts/m-p/207606#M40922 richgalloway 2016-12-28T20:28:06Z