Splunk Search

Get the timestamp of stats latest(field)

artrune
Path Finder

I'm currently getting the latest value of a field like: | stats latest("field").
However It only shows the column with the value and it doesn't show the column with the timestamp.
If i add latest("_time" ) that wont work if there are other newer entries that don't include the field I'm aiming for.
How can I retrieve the latest value of a field with its timestamp?

0 Karma
1 Solution

woodcock
Esteemed Legend

You can do this:

... | stats max(_time) AS _time BY field | sort 0 - _time | head 1

View solution in original post

0 Karma

artrune
Path Finder

alt textThis is what i currently have and want to add the timestamp column

0 Karma

artrune
Path Finder

alt text

Thanks, but it comes with alot of dates and values and not the latest value for the field

0 Karma

woodcock
Esteemed Legend

You can do this:

... | stats max(_time) AS _time BY field | sort 0 - _time | head 1
0 Karma

artrune
Path Finder

Thanks for your reply, I tried that but it didnt return anything.

0 Karma

artrune
Path Finder

Nevermind, this did work but i h ad to put my field inside double quotes. Thanks

0 Karma

woodcock
Esteemed Legend

Field names with spaces are evil.

0 Karma

artrune
Path Finder

Hmm its funny, because it worked on the search (inside splunk) but when calling through the api im not getting any response. With the previous query i would get response on the API.
Do you have any idea?

0 Karma

artrune
Path Finder

Nevermind haha i was missing the double quotes inside my code. Just had to escape them.
Thanks for the help

0 Karma

Sukisen1981
Champion
|  stats latest(fieldname) by _time
| reverse

???

0 Karma

artrune
Path Finder

Thanks for your reply aswell, When trying this it returns a lot of time stamps and and values.
I want only the latest value for my field with its timestamp

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...