Display last results

[jsmith39]

I have a list of servers that do data backups to disk on a week night basis and I've built a query to display the results, and it works great, except on Mondays. Tues-Fri morning the query looks over the last 24 hours and tells me if something happened. Since the servers don't backup on Sat/Sun though, Monday morning I'm always have to tweak the time/date range to get results, and I'd like to change that.

My query is |inputlookup sosservers.csv | join type=outer ComputerName [search sourcetype="WMI:WinEventLog:Application" Database backed up BICS | stats count by ComputerName]

If I end it with .. | head 1 then I only get the last record of one of the 40+ servers it's looking at, so that won't work.

How can I change this query to simply return the latest results for each server in the WMI:WinEventLog:Application sourcetype?

Thank You

[martin_mueller · Accepted solution]

To only get the most recent event for each field, you can do this:

base search | streamstats count by field | where count=1

[martin_mueller]

Sure.

base search | streamstats latest(_time) as latest_time by field | where _time=latest_time

[jsmith39]

Thank You, that worked perfectly.
Unfortunately it raised another issue I hadn't though of.

The current query returns a field called count and places a 1 in that field. Which was good enough when I knew it had occurred in the last 24 hours. Now I don't know when it occurred unless I check it. Do you know how I could change the results in the count field to display the time/date stamp of the record it's referencing?

Thank You