Find latest date for a record

[Stephen11]

Tried  a couple of functions ... nothing easy...

Example (index=XXX) AND event="XXXXXX" | eval tim =strftime(_time,"%m/%d/%Y") | eventstats max(tim) as maxDate| stats count by dvchost, maxDate

I need to figure out how to find the most recent records....  code does not work... looked at other ways to do it .... nothing easy... help

[Nisha18789]

Hi @Stephen11 , please try this

 (index=XXX) AND event="XXXXXX" | stats latest(_time) as latestDate  by dvchost

|eval latestDate =strftime(latestDate ,"%m/%d/%Y")

Hope this helps!

Please upvote my response if this resolves the issue.

[isoutamo]

Hi

you should check also stat latest_time(_time) to see which one is the correct function for this time. Time by time those two gives different value. 
r. Ismo