topic Fetch latest timestamp of search records in Alerting

Fetch latest timestamp of search records

anmohan0 — Fri, 19 Jul 2024 15:12:02 GMT

Hi,

I would like to get the latest search record or multiple search combination.

For example, if my search is as below

index=myIndex ABCD AND (Input OR Error)

I am expecting output as below table format

Component | Last Input Timestamp| Last Errored Timestamp

ABCD | 24-03-2024 12:23:23| 24-03-2024 08:23:12

Search should fetch the timestamp of latest log event of (ABCD and Input) and (ABCD and Error).

Re: Fetch latest timestamp of search records

ITWhisperer — Fri, 19 Jul 2024 16:05:04 GMT

| stats latest(eval(if(searchmatch("Error"),_time,null()))) as LastErroredTimestamp latest(eval(if(searchmatch("Input"),_time,null()))) as LastInputTimestamp by Component | fieldformat LastErroredTimestamp=strftime(LastErroredTimestamp,"%F %T") | fieldformat LastInputTimestamp=strftime(LastInputTimestamp,"%F %T")

Re: Fetch latest timestamp of search records

anmohan0 — Fri, 19 Jul 2024 16:39:40 GMT

@ITWhisperer Thank you very much and you made my day to achieve the desired output.

Also I would like to pass Component as a dropdown which could be either 1 or 2 or 3 comma separated values as AAAA, BBBB, CCCC and expecting output for each component it should display the Last Input Timestamp and Last Output Timestamp

Component | Last Input Timestamp| Last Errored Timestamp

AAAA | 24-03-2024 12:23:23| 24-03-2024 08:23:12

BBBB | 23-03-2024 10:12:44| 24-02-2024 05:45:22

CCCC | 12-05-2024 11:01:00| 04-05-2024 01:23:12

Any help to achieve this would be really appreciated!

Re: Fetch latest timestamp of search records

ITWhisperer — Fri, 19 Jul 2024 17:32:04 GMT

This is a different question - you could modify your search to use something like Component IN $componentselection$ but it depends on how your dashboard is set up

Re: Fetch latest timestamp of search records

anmohan0 — Mon, 20 Jan 2025 06:01:27 GMT

Thanks a lot @ITWhisperer , you saved me and it works seamlessly the way I wanted