Dashboards & Visualizations

can you help me on last event displaying

jip31
Motivator

hello
when I execute the request below, i want to display only the last event without playing with token time or doing a dedup time
index="windows-wmi" sourcetype="wmi:diskdrive" | table host Caption DeviceID FirmwareRevision Status
how to do please?

Tags (1)
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

You could use the tail command:

index="windows-wmi" sourcetype="wmi:diskdrive" | table host Caption DeviceID FirmwareRevision Status | tail 1

0 Karma

niketn
Legend

@jip31 you should define whether you are interested in last event or latest event.

For latest event you should perform <yourCurrentSearch> | head 1

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jip31
Motivator

Hello niketnilay i dont know if you have seen my comment before : for one host i have To events every hour. So for every host i need the Two last Event. Head 1 works only for one host and one event

0 Karma

niketn
Legend

If that is the case then you need stats/dedup by each hour so that you can identify two events. Any reason why you dont want to use either one?

Is there a way to filter each of the two events per hour uniquely?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

harishalipaka
Motivator

@jip31

|sort _time
Thanks
Harish
0 Karma

niketn
Legend

@harishalipaka although your answer might not be what @jip31 might be looking for, | reverse will work faster than | sort command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...