Re: Charting last seen date - Splunk Community

Splunk Search

Looking to chart when a host/device was last seen.

Host date
server A 3/25/2012
server B 3/24/2012
server C 3/28/2012

Something like that. Date format doesn't have to be that way.

... | dedup host | table host _time

Use eval instead of fieldformat.

Okay but when I got od odo a fieldformat such as
| dedup host | fieldformat Stime = strftime(_time,"%m/%d/%Y") | table Stime

I get no output.

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...