Getting Data In

How to GET latest and previous events from a different host?

jadengoho
Builder

Hi all ,
This is my problem : I have a table with time,log and host.
sample :

host 1  <event log> 2018-06-05 23:01:30
host 2  <event log> 2018-06-05 23:01:30

host 2  <event log> 2018-06-05 23:01:29
host 3  <event log> 2018-06-05 23:01:29

host 1  <event log> 2018-06-05 23:01:28
host 3  <event log> 2018-06-05 23:01:28

host 1  <event log> 2018-06-05 23:01:27
host 2  <event log> 2018-06-05 23:01:27
host 3  <event log> 2018-06-05 23:01:27

......

Now i want to only get was the latest and the previous
like this :

LATEST
host 1    <event log> 2018-06-05 23:01:30
host 2    <event log> 2018-06-05 23:01:30
host 3    <event log> 2018-06-05 23:01:29

PREVIOUS 
host 1    <event log> 2018-06-05 23:01:28
host 2    <event log> 2018-06-05 23:01:29
host 3    <event log> 2018-06-05 23:01:28

Is there a way or workaround to get this result ?
Thanks in advance

0 Karma
1 Solution

493669
Super Champion

use dedup command to get latest 2 events :

...|dedup 2 host

View solution in original post

0 Karma

493669
Super Champion

use dedup command to get latest 2 events :

...|dedup 2 host
0 Karma

jadengoho
Builder

I am not aware that i can do this , will definitely try this

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...