I would like to display the last event time when using stats function. the following search string works but the time is not human readable. I tried to use the convert function strftime(last(_time), "%m/%d %H:%M:%S") but it's not working.
I would sppreciate if anyone could shed some light on this. Thanks!
stats max(timeinsec), min(timeinsec), avg(timeinsec), last(_time) by url
Since you want to display the time stamp of the most recent event in the results, I would recommend using latest() instead of last(). Consider the following definition of latest():
latest(X) This function returns the chronologically latest seen occurrence of a value of a field X.
Anyway, I here is the suggested search string:
... | stats max(time_in_sec), min(time_in_sec), avg(time_in_sec), latest(_time) AS latest_time by url | convert ctime(latest_time)
I like the answer.
Shangshin, just note that latest is a function of stats only in Splunk versions past 4.3. If you have <4.3, try "| stats max(timeinsec), min(timeinsec) avg(timeinsec), first(time) as latesttime by url | convert ctime(latest_time)"