Getting Data In

How to GET latest and previous events from a different host?

jadengoho
Builder

Hi all ,
This is my problem : I have a table with time,log and host.
sample :

host 1  <event log> 2018-06-05 23:01:30
host 2  <event log> 2018-06-05 23:01:30

host 2  <event log> 2018-06-05 23:01:29
host 3  <event log> 2018-06-05 23:01:29

host 1  <event log> 2018-06-05 23:01:28
host 3  <event log> 2018-06-05 23:01:28

host 1  <event log> 2018-06-05 23:01:27
host 2  <event log> 2018-06-05 23:01:27
host 3  <event log> 2018-06-05 23:01:27

......

Now i want to only get was the latest and the previous
like this :

LATEST
host 1    <event log> 2018-06-05 23:01:30
host 2    <event log> 2018-06-05 23:01:30
host 3    <event log> 2018-06-05 23:01:29

PREVIOUS 
host 1    <event log> 2018-06-05 23:01:28
host 2    <event log> 2018-06-05 23:01:29
host 3    <event log> 2018-06-05 23:01:28

Is there a way or workaround to get this result ?
Thanks in advance

0 Karma
1 Solution

493669
Super Champion

use dedup command to get latest 2 events :

...|dedup 2 host

View solution in original post

0 Karma

493669
Super Champion

use dedup command to get latest 2 events :

...|dedup 2 host
0 Karma

jadengoho
Builder

I am not aware that i can do this , will definitely try this

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...