Splunk Search

Display Last Event Time in Stats function

shangshin
Builder

Hi,
I would like to display the last event time when using stats function. the following search string works but the time is not human readable. I tried to use the convert function strftime(last(_time), "%m/%d %H:%M:%S") but it's not working.

I would sppreciate if anyone could shed some light on this. Thanks!

stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), last(_time) by url

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

Since you want to display the time stamp of the most recent event in the results, I would recommend using latest() instead of last(). Consider the following definition of latest():

latest(X)    This function returns the chronologically latest seen occurrence of a value of a field X.

Anyway, I here is the suggested search string:

... | stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), latest(_time) AS latest_time by url | convert ctime(latest_time)

View solution in original post

hexx
Splunk Employee
Splunk Employee

Since you want to display the time stamp of the most recent event in the results, I would recommend using latest() instead of last(). Consider the following definition of latest():

latest(X)    This function returns the chronologically latest seen occurrence of a value of a field X.

Anyway, I here is the suggested search string:

... | stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), latest(_time) AS latest_time by url | convert ctime(latest_time)

shangshin
Builder

Thanks for the info. My splunk version is 4.3.1 but the function, latest, seems not working.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I like the answer.

Shangshin, just note that latest is a function of stats only in Splunk versions past 4.3. If you have <4.3, try "| stats max(time_in_sec), min(time_in_sec) avg(time_in_sec), first(_time) as latest_time by url | convert ctime(latest_time)"

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...