topic Re: How to get the latest timestamp by host? in Getting Data In

How to get the latest timestamp by host?

ppatkar — Tue, 28 May 2019 16:57:04 GMT

I need to list all the hosts with their latest Splunk event timestamps in YYYY-MMM-DD HH24:MI:SS format .
Below seems to be suffice , however I am unable to change the date & time format for required results :

tstats latest(_time) where index=abc by host

Any help or insights is appreciated.

Re: How to get the latest timestamp by host?

DavidHourani — Tue, 28 May 2019 17:06:42 GMT

Hi @ppatkar,

Does something like this work for you ?

| tstats latest(_time) AS _time where index=abc by host | eval _time=strftime(_time,"%m/%d/%y %H:%M:%S")

Cheers,
David

Re: How to get the latest timestamp by host?

ppatkar — Tue, 28 May 2019 17:11:43 GMT

Thanks David, after searching for similar posts could manage the below :

| tstats latest(_time) AS latest where index=abc by host | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(latest)

Re: How to get the latest timestamp by host?

DavidHourani — Tue, 28 May 2019 17:13:33 GMT

awesome, glad to know you found a solution !