Splunk Search

Display Last Event Time in Stats function

shangshin
Builder

Hi,
I would like to display the last event time when using stats function. the following search string works but the time is not human readable. I tried to use the convert function strftime(last(_time), "%m/%d %H:%M:%S") but it's not working.

I would sppreciate if anyone could shed some light on this. Thanks!

stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), last(_time) by url

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

Since you want to display the time stamp of the most recent event in the results, I would recommend using latest() instead of last(). Consider the following definition of latest():

latest(X)    This function returns the chronologically latest seen occurrence of a value of a field X.

Anyway, I here is the suggested search string:

... | stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), latest(_time) AS latest_time by url | convert ctime(latest_time)

View solution in original post

hexx
Splunk Employee
Splunk Employee

Since you want to display the time stamp of the most recent event in the results, I would recommend using latest() instead of last(). Consider the following definition of latest():

latest(X)    This function returns the chronologically latest seen occurrence of a value of a field X.

Anyway, I here is the suggested search string:

... | stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), latest(_time) AS latest_time by url | convert ctime(latest_time)

shangshin
Builder

Thanks for the info. My splunk version is 4.3.1 but the function, latest, seems not working.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I like the answer.

Shangshin, just note that latest is a function of stats only in Splunk versions past 4.3. If you have <4.3, try "| stats max(time_in_sec), min(time_in_sec) avg(time_in_sec), first(_time) as latest_time by url | convert ctime(latest_time)"

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...