https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24132#M4384 <P>I think you are looking for:</P> <PRE><CODE>| head 1 | addinfo </CODE></PRE> <P>The time the search was executed will be in the <EM>info_search_time</EM> field</P> Thu, 07 Feb 2013 23:23:29 GMT Paolo_Prigione 2013-02-07T23:23:29Z https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24129#M4381 <P>Hi,</P> <P>How would I go about getting the latest value of a search, along with the timestamp of that search? I want to include it in a table. </P> Thu, 07 Feb 2013 21:28:10 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24129#M4381 a212830 2013-02-07T21:28:10Z https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24130#M4382 <P>This would get you the latest result:</P> <PRE><CODE>... | head 1 </CODE></PRE> <P>Not sure if that's what you want, hard to guess from the question.</P> Thu, 07 Feb 2013 22:43:48 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24130#M4382 martin_mueller 2013-02-07T22:43:48Z https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24131#M4383 <P>You can also get the most recent value of a particular field using the "first" function in stats:</P> <PRE><CODE>... | stats first(X) </CODE></PRE> Thu, 07 Feb 2013 23:02:05 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24131#M4383 sbrant_splunk 2013-02-07T23:02:05Z https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24132#M4384 <P>I think you are looking for:</P> <PRE><CODE>| head 1 | addinfo </CODE></PRE> <P>The time the search was executed will be in the <EM>info_search_time</EM> field</P> Thu, 07 Feb 2013 23:23:29 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24132#M4384 Paolo_Prigione 2013-02-07T23:23:29Z https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24133#M4385 <P>Sorry that I wasn't more specific. I want to grab data from the previous hour, and I want to get the value of the last event, along with the timestamp associated with that last event. I'll try these, but I'm don't think they are what I'm looking for...</P> Fri, 08 Feb 2013 04:40:39 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24133#M4385 a212830 2013-02-08T04:40:39Z https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24134#M4386 <P>I've found the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions">stat functions</A> 'earliest' and 'latest' work best for time-dependent field reporting:</P> <PRE><CODE>... | stats latest(_time) as _time, latest(X) </CODE></PRE> Tue, 28 Mar 2017 18:34:04 GMT https://community.splunk.com/t5/Splunk-Search/get-latest-value-and-timestamp/m-p/24134#M4386 stoomart 2017-03-28T18:34:04Z