topic Re: Find latest date for a record in Getting Data In

Find latest date for a record

Stephen11 — Fri, 21 Aug 2020 21:26:33 GMT

Tried a couple of functions ... nothing easy...

Example (index=XXX) AND event="XXXXXX" | eval tim =strftime(_time,"%m/%d/%Y") | eventstats max(tim) as maxDate| stats count by dvchost, maxDate

I need to figure out how to find the most recent records.... code does not work... looked at other ways to do it .... nothing easy... help

Re: Find latest date for a record

Nisha18789 — Fri, 21 Aug 2020 21:39:18 GMT

Hi @Stephen11 , please try this

(index=XXX) AND event="XXXXXX" | stats latest(_time) as latestDate by dvchost

|eval latestDate =strftime(latestDate ,"%m/%d/%Y")

Hope this helps!

Please upvote my response if this resolves the issue.

Re: Find latest date for a record

isoutamo — Sun, 23 Aug 2020 10:12:49 GMT

you should check also stat latest_time(_time) to see which one is the correct function for this time. Time by time those two gives different value.
r. Ismo