How to get the latest timestamp by host?

[ppatkar]

I need to list all the hosts with their latest Splunk event timestamps in YYYY-MMM-DD HH24:MI:SS format .
Below seems to be suffice , however I am unable to change the date & time format for required results :

tstats latest(_time) where index=abc by host

Any help or insights is appreciated.

[DavidHourani · Accepted solution]

Hi @ppatkar,

Does something like this work for you ?

| tstats latest(_time) AS _time where index=abc by host | eval _time=strftime(_time,"%m/%d/%y %H:%M:%S")

Cheers,
David

[ppatkar]

Thanks David, after searching for similar posts could manage the below :

| tstats latest(_time) AS latest where index=abc by host | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(latest)

[DavidHourani]

awesome, glad to know you found a solution !