topic Re: Last event grouped by in Splunk Search

Last event grouped by

oscargarcia — Thu, 02 Jun 2011 17:40:16 GMT

Hi,

I am building an app for managing some network switches. One of the views I want to create has the same data list:

For a given period of time, grouped by host, the date of the last event that matches certain criteria.

I can do that easily with "| tail 1", but that only covers one host or query. With the stats command, I can easily find the number of events matched grouped by host, but I am struggling to find the last one only for every host.

Any ideas?

Many thanks!

Re: Last event grouped by

mw — Thu, 02 Jun 2011 18:05:32 GMT

How about:

... | stats last(_raw) by host

Re: Last event grouped by

oscargarcia — Thu, 02 Jun 2011 21:28:27 GMT

so elegant... I love it... thanks!

Re: Last event grouped by

YisroelB — Thu, 27 Jun 2013 20:35:58 GMT

It seems that once you do this you lose access to the fields and would have to parse it out manually. For example if you pipe the above to "| table _time" _time is empty. Any way around this?

Re: Last event grouped by

Ayn — Thu, 27 Jun 2013 20:58:01 GMT

dedup host