https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437759#M124637 <P>Field names with spaces are evil.</P> Thu, 02 May 2019 16:58:03 GMT woodcock 2019-05-02T16:58:03Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437751#M124629 <P>I'm currently getting the latest value of a field like: | stats latest("field").<BR /> However It only shows the column with the value and it doesn't show the column with the timestamp. <BR /> If i add latest("_time" ) that wont work if there are other newer entries that don't include the field I'm aiming for.<BR /> How can I retrieve the latest value of a field with its timestamp?</P> Thu, 02 May 2019 15:58:16 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437751#M124629 artrune 2019-05-02T15:58:16Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437752#M124630 <PRE><CODE>| stats latest(fieldname) by _time | reverse </CODE></PRE> <P>???</P> Thu, 02 May 2019 16:43:18 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437752#M124630 Sukisen1981 2019-05-02T16:43:18Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437753#M124631 <P>You can do this:</P> <PRE><CODE>... | stats max(_time) AS _time BY field | sort 0 - _time | head 1 </CODE></PRE> Thu, 02 May 2019 16:44:57 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437753#M124631 woodcock 2019-05-02T16:44:57Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437754#M124632 <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6972i346CE1BE17DBAAE6/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Thanks, but it comes with alot of dates and values and not the latest value for the field</P> Thu, 02 May 2019 16:47:18 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437754#M124632 artrune 2019-05-02T16:47:18Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437755#M124633 <P>Thanks for your reply, I tried that but it didnt return anything.</P> Thu, 02 May 2019 16:49:17 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437755#M124633 artrune 2019-05-02T16:49:17Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437756#M124634 <P>Thanks for your reply aswell, When trying this it returns a lot of time stamps and and values.<BR /> I want only the latest value for my field with its timestamp</P> Thu, 02 May 2019 16:49:58 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437756#M124634 artrune 2019-05-02T16:49:58Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437757#M124635 <P><IMG src="http://i67.tinypic.com/2woklsi.png" alt="alt text" />This is what i currently have and want to add the timestamp column</P> Thu, 02 May 2019 16:51:34 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437757#M124635 artrune 2019-05-02T16:51:34Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437758#M124636 <P>Nevermind, this did work but i h ad to put my field inside double quotes. Thanks</P> Thu, 02 May 2019 16:53:15 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437758#M124636 artrune 2019-05-02T16:53:15Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437759#M124637 <P>Field names with spaces are evil.</P> Thu, 02 May 2019 16:58:03 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437759#M124637 woodcock 2019-05-02T16:58:03Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437760#M124638 <P>Hmm its funny, because it worked on the search (inside splunk) but when calling through the api im not getting any response. With the previous query i would get response on the API. <BR /> Do you have any idea?</P> Thu, 02 May 2019 17:01:38 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437760#M124638 artrune 2019-05-02T17:01:38Z https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437761#M124639 <P>Nevermind haha i was missing the double quotes inside my code. Just had to escape them.<BR /> Thanks for the help</P> Thu, 02 May 2019 17:04:46 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-timestamp-of-stats-latest-field/m-p/437761#M124639 artrune 2019-05-02T17:04:46Z