Can I use tstats and get most recent event date

[a212830]

Hi,

Is it possible to get the data of the most recent event per sourcetype when using tstats? I have a search - |tstats count WHERE index=ngccc* AND (host=vlmmk179 OR host=vlrtp218) by host, sourcetype

that returns what I want, but I was wondering if it was possible to add the most recent event for host and sourcetype combination?

[sloshburch]

Not exactly what you're looking for, but don't forget the metadata command just for finding information about what's in the indexes.

[somesoni2]

I think you can. Try something like this

|tstats count max(_time) as _time WHERE index=ngccc* AND (host=vlmmk179 OR host=vlrtp218) by host, sourcetype