Fetch latest timestamp of search records

[anmohan0]

Hi,

I would like to get the latest search record or multiple search combination.

For example, if my search is as below

index=myIndex ABCD AND (Input OR Error)

I am expecting output as below table format

Component | Last Input Timestamp| Last Errored Timestamp

ABCD             | 24-03-2024 12:23:23| 24-03-2024 08:23:12

Search should fetch the timestamp of latest log event of (ABCD and Input) and (ABCD and Error). 

[anmohan0]

Thanks a lot @ITWhisperer , you saved me and it works seamlessly the way I wanted

[anmohan0]

@ITWhisperer Thank you very much and you made my day to achieve the desired output.

Also I would like to pass Component as a dropdown which could be either 1 or 2 or 3 comma separated values as AAAA, BBBB, CCCC and expecting output for each component it should display the Last Input Timestamp and Last Output Timestamp

Component | Last Input Timestamp| Last Errored Timestamp

AAAA             | 24-03-2024 12:23:23| 24-03-2024 08:23:12

BBBB             | 23-03-2024 10:12:44| 24-02-2024 05:45:22

CCCC             | 12-05-2024 11:01:00| 04-05-2024 01:23:12

Any help to achieve this would be really appreciated!

[ITWhisperer]

This is a different question - you could modify your search to use something like Component IN $componentselection$ but it depends on how your dashboard is set up

[ITWhisperer · Accepted solution]

| stats latest(eval(if(searchmatch("Error"),_time,null()))) as LastErroredTimestamp latest(eval(if(searchmatch("Input"),_time,null()))) as LastInputTimestamp by Component
| fieldformat LastErroredTimestamp=strftime(LastErroredTimestamp,"%F %T")
| fieldformat LastInputTimestamp=strftime(LastInputTimestamp,"%F %T")