I need to list all the hosts with their latest Splunk event timestamps in YYYY-MMM-DD HH24:MI:SS format .
Below seems to be suffice , however I am unable to change the date & time format for required results :
tstats latest(_time) where index=abc by host
Any help or insights is appreciated.
Does something like this work for you ?
| tstats latest(_time) AS _time where index=abc by host | eval _time=strftime(_time,"%m/%d/%y %H:%M:%S")
View solution in original post
Thanks David, after searching for similar posts could manage the below :
| tstats latest(_time) AS latest where index=abc by host | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(latest)
awesome, glad to know you found a solution !