Tried a couple of functions ... nothing easy...
Example (index=XXX) AND event="XXXXXX" | eval tim =strftime(_time,"%m/%d/%Y") | eventstats max(tim) as maxDate| stats count by dvchost, maxDate
I need to figure out how to find the most recent records.... code does not work... looked at other ways to do it .... nothing easy... help
Hi @Stephen11 , please try this
(index=XXX) AND event="XXXXXX" | stats latest(_time) as latestDate by dvchost
|eval latestDate =strftime(latestDate ,"%m/%d/%Y")
Hope this helps!
Please upvote my response if this resolves the issue.
you should check also stat latest_time(_time) to see which one is the correct function for this time. Time by time those two gives different value. r. Ismo