Splunk Search

Display Last Event Time in Stats function

shangshin
Builder

Hi,
I would like to display the last event time when using stats function. the following search string works but the time is not human readable. I tried to use the convert function strftime(last(_time), "%m/%d %H:%M:%S") but it's not working.

I would sppreciate if anyone could shed some light on this. Thanks!

stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), last(_time) by url

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

Since you want to display the time stamp of the most recent event in the results, I would recommend using latest() instead of last(). Consider the following definition of latest():

latest(X)    This function returns the chronologically latest seen occurrence of a value of a field X.

Anyway, I here is the suggested search string:

... | stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), latest(_time) AS latest_time by url | convert ctime(latest_time)

View solution in original post

hexx
Splunk Employee
Splunk Employee

Since you want to display the time stamp of the most recent event in the results, I would recommend using latest() instead of last(). Consider the following definition of latest():

latest(X)    This function returns the chronologically latest seen occurrence of a value of a field X.

Anyway, I here is the suggested search string:

... | stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), latest(_time) AS latest_time by url | convert ctime(latest_time)

shangshin
Builder

Thanks for the info. My splunk version is 4.3.1 but the function, latest, seems not working.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I like the answer.

Shangshin, just note that latest is a function of stats only in Splunk versions past 4.3. If you have <4.3, try "| stats max(time_in_sec), min(time_in_sec) avg(time_in_sec), first(_time) as latest_time by url | convert ctime(latest_time)"

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...