topic stats latest not returning a value in Splunk Search

stats latest not returning a value

cphair — Mon, 28 Sep 2020 11:39:56 GMT

Hello,

I have a silly problem. I can't get stats latest(_time) to return a value. It's a basic search--just trying to find the last time each host reported in.



index=foo | stats latest(_time) by host

earliest(_time) seems to work, and so do the first and last functions, but latest just gives me a blank entry. What's going on? If it matters, this is perfmon data and I think it's pretty clean. It's not just the _time field either; no field I pass to latest is giving me a result.

Re: stats latest not returning a value

Ayn — Wed, 11 Apr 2012 15:13:41 GMT

This most definitely seems to be a bug. Others have reported the same problem, so you're not alone. Have a look at http://splunk-base.splunk.com/answers/42084/latest-function-in-stats-not-working-without-earliest

Re: stats latest not returning a value

cphair — Wed, 11 Apr 2012 15:17:13 GMT

Yep, that's exactly it. Guess I should search more carefully before I post. Thanks!

My Splunk version is 4.3 build 115073, if that helps you.

Re: stats latest not returning a value

kristian_kolb — Wed, 11 Apr 2012 15:41:25 GMT

In the mean time, use;

|metadata type=hosts index=foo | eval Last_seen = strftime(lastTime, "%Y-%m-%d %H:%M:%S")| fields + host Last_seen

EDIT: Much faster than what I just posted. Deleted that. Sorry.
EDIT AGAIN: cut-n-paste silliness. Corrected now.

Re: stats latest not returning a value

cphair — Wed, 11 Apr 2012 17:07:30 GMT

Works nicely. Thank you.

Re: stats latest not returning a value

araitz — Wed, 11 Apr 2012 17:14:29 GMT

Please see http://splunk-base.splunk.com/answers/42084/latest-function-in-stats-not-working-without-earliest/45293

Re: stats latest not returning a value

srowe — Tue, 26 Mar 2013 20:45:54 GMT

I don't understand the workaround. Where are we supposed to get lastTime? isn't that the whole point with using the latest function? I am using version 5.0.1 and still experiencing this issue.

Re: stats latest not returning a value

kristian_kolb — Tue, 26 Mar 2013 20:54:55 GMT

The workaround is for this particular question: "At what time did we receive the last message for each host?"

This can be answered by querying the metdata instead of the events themselves. Pretty much the same by which Splunk instantly 'knows' and presents the times for the oldest/newest event in the landing page for the Search app and for each index in Manager -> Indexes.

The lastTime is returned (in epoch format) by the |metadata search command. To present it in a nicer fashion it is then eval:ed with strftime.

Have you tried it?