https://community.splunk.com/t5/Splunk-Search/Charting-last-seen-date/m-p/103042#M26613 <PRE><CODE>... | dedup host | table host _time </CODE></PRE> Wed, 28 Mar 2012 15:20:01 GMT Ayn 2012-03-28T15:20:01Z https://community.splunk.com/t5/Splunk-Search/Charting-last-seen-date/m-p/103041#M26612 <P>Looking to chart when a host/device was last seen. </P> <P>Host date<BR /> server A 3/25/2012<BR /> server B 3/24/2012<BR /> server C 3/28/2012</P> <P>Something like that. Date format doesn't have to be that way.</P> Wed, 28 Mar 2012 14:42:26 GMT https://community.splunk.com/t5/Splunk-Search/Charting-last-seen-date/m-p/103041#M26612 mlevenson 2012-03-28T14:42:26Z https://community.splunk.com/t5/Splunk-Search/Charting-last-seen-date/m-p/103042#M26613 <PRE><CODE>... | dedup host | table host _time </CODE></PRE> Wed, 28 Mar 2012 15:20:01 GMT https://community.splunk.com/t5/Splunk-Search/Charting-last-seen-date/m-p/103042#M26613 Ayn 2012-03-28T15:20:01Z https://community.splunk.com/t5/Splunk-Search/Charting-last-seen-date/m-p/103043#M26614 <P>Okay but when I got od odo a fieldformat such as <BR /> | dedup host | fieldformat Stime = strftime(_time,"%m/%d/%Y") | table Stime</P> <P>I get no output.</P> Wed, 28 Mar 2012 16:09:17 GMT https://community.splunk.com/t5/Splunk-Search/Charting-last-seen-date/m-p/103043#M26614 mlevenson 2012-03-28T16:09:17Z https://community.splunk.com/t5/Splunk-Search/Charting-last-seen-date/m-p/103044#M26615 <P>Use <CODE>eval</CODE> instead of <CODE>fieldformat</CODE>.</P> Wed, 28 Mar 2012 16:15:22 GMT https://community.splunk.com/t5/Splunk-Search/Charting-last-seen-date/m-p/103044#M26615 Ayn 2012-03-28T16:15:22Z