Dashboards & Visualizations

can you help me on last event displaying

jip31
Motivator

hello
when I execute the request below, i want to display only the last event without playing with token time or doing a dedup time
index="windows-wmi" sourcetype="wmi:diskdrive" | table host Caption DeviceID FirmwareRevision Status
how to do please?

Tags (1)
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

You could use the tail command:

index="windows-wmi" sourcetype="wmi:diskdrive" | table host Caption DeviceID FirmwareRevision Status | tail 1

0 Karma

niketn
Legend

@jip31 you should define whether you are interested in last event or latest event.

For latest event you should perform <yourCurrentSearch> | head 1

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jip31
Motivator

Hello niketnilay i dont know if you have seen my comment before : for one host i have To events every hour. So for every host i need the Two last Event. Head 1 works only for one host and one event

0 Karma

niketn
Legend

If that is the case then you need stats/dedup by each hour so that you can identify two events. Any reason why you dont want to use either one?

Is there a way to filter each of the two events per hour uniquely?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

harishalipaka
Motivator

@jip31

|sort _time
Thanks
Harish
0 Karma

niketn
Legend

@harishalipaka although your answer might not be what @jip31 might be looking for, | reverse will work faster than | sort command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...