https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139827#M38488 <P>Sorry, maybe I explained this incorrectly. I have a bunch of host that forward logs to Splunk in the form of a csv line every min. I want to do a search of every host, but only get the last line of the log that has been forwarded by the host. So instead of searching every event on each host, I just need to grab the last event for a sourcetype.</P> Thu, 09 Apr 2015 16:24:19 GMT chadman 2015-04-09T16:24:19Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139825#M38486 <P>I have a csv file on every computer and need to just search the last event for eveyy host. I can't get a search to work without searching every event on every host. I have used dedup, but it still searches every host.</P> Thu, 09 Apr 2015 15:08:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139825#M38486 chadman 2015-04-09T15:08:12Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139826#M38487 <P>Here is an expensive way with ugly output using the <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Map">map command</A></P> <PRE><CODE>| stats count | eval host="host_a,host_b,host_c" | makemv delim="," host | mvexpand host | map search="search host=$host$ | head 1 " </CODE></PRE> <P>Using your CSV file it might look like this...</P> <PRE><CODE>| stats count | inputlookup=host_csv | map search="search host=$host$ | head 1 " </CODE></PRE> <P></P><H4>Better Solution</H4>Actually, host info can be queried by metadata so this <A href="http://answers.splunk.com/answers/52891/most-recent-event-from-each-source.html">"Most recent event from each source?" answer</A> from Ayn may be adapted to solve this problem more neatly.<P></P> Thu, 09 Apr 2015 15:57:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139826#M38487 bwooden 2015-04-09T15:57:31Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139827#M38488 <P>Sorry, maybe I explained this incorrectly. I have a bunch of host that forward logs to Splunk in the form of a csv line every min. I want to do a search of every host, but only get the last line of the log that has been forwarded by the host. So instead of searching every event on each host, I just need to grab the last event for a sourcetype.</P> Thu, 09 Apr 2015 16:24:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139827#M38488 chadman 2015-04-09T16:24:19Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139828#M38489 <P>Here is what I use now and it works, but I think it's seaching every event. I only want it to look at the last event for every host to speed up the search. sourcetype="my source" | where Available_D &lt; 100 | dedup host | sort Available_D a |table host,Available_D </P> Mon, 28 Sep 2020 19:30:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139828#M38489 chadman 2020-09-28T19:30:01Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139829#M38490 <P>I'd probably abstract this into a lookup file holding state. Specifically, keep in your lookup file the most recent event per host. When you update it incrementally, it is cheap -- and getting the current state from the lookup is super cheap.</P> <P>A similar answer is here:</P> <P><A href="http://answers.splunk.com/answers/216701/how-to-send-an-alert-email-the-first-time-since-th.html">http://answers.splunk.com/answers/216701/how-to-send-an-alert-email-the-first-time-since-th.html</A></P> Thu, 09 Apr 2015 21:22:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139829#M38490 dwaddle 2015-04-09T21:22:52Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139830#M38491 <P>I tried that, but have not gotten it to work yet. I would think there would be an eaiser way to work with the last line from every host.</P> Tue, 14 Apr 2015 12:46:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139830#M38491 chadman 2015-04-14T12:46:56Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139831#M38492 <P>I will try to bake up a concrete example today/tonight of doing this via lookup. Check this space.</P> Tue, 14 Apr 2015 13:07:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139831#M38492 dwaddle 2015-04-14T13:07:01Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139832#M38493 <P>great, let me know if you come up with something</P> Wed, 15 Apr 2015 15:40:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139832#M38493 chadman 2015-04-15T15:40:32Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139833#M38494 <P>Hi chadman<BR /> to get last value of a host field you can use last() function with stats cammand </P> <P>see the following serch code</P> <PRE><CODE> sourcetype="my source" | where Available_D &lt; 100 | dedup host |stats last(host) as last_host| sort Available_D a |table last_host Available_D </CODE></PRE> Wed, 15 Apr 2015 16:05:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-that-returns-the-most-recent-event-for-a/m-p/139833#M38494 chimell 2015-04-15T16:05:04Z