Getting Data In

Find latest date for a record


Tried  a couple of functions ... nothing easy...

Example (index=XXX) AND event="XXXXXX" | eval tim =strftime(_time,"%m/%d/%Y") | eventstats max(tim) as maxDate| stats count by dvchost, maxDate

I need to figure out how to find the most recent records....  code does not work... looked at other ways to do it .... nothing easy... help


0 Karma


Hi @Stephen11 , please try this

 (index=XXX) AND event="XXXXXX" | stats latest(_time) as latestDate  by dvchost

|eval latestDate =strftime(latestDate ,"%m/%d/%Y")


Hope this helps!

Please upvote my response if this resolves the issue.

0 Karma



you should check also stat latest_time(_time) to see which one is the correct function for this time. Time by time those two gives different value. 
r. Ismo

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...