Splunk Search

Get the timestamp of stats latest(field)

artrune
Path Finder

I'm currently getting the latest value of a field like: | stats latest("field").
However It only shows the column with the value and it doesn't show the column with the timestamp.
If i add latest("_time" ) that wont work if there are other newer entries that don't include the field I'm aiming for.
How can I retrieve the latest value of a field with its timestamp?

0 Karma
1 Solution

woodcock
Esteemed Legend

You can do this:

... | stats max(_time) AS _time BY field | sort 0 - _time | head 1

View solution in original post

0 Karma

artrune
Path Finder

alt textThis is what i currently have and want to add the timestamp column

0 Karma

artrune
Path Finder

alt text

Thanks, but it comes with alot of dates and values and not the latest value for the field

0 Karma

woodcock
Esteemed Legend

You can do this:

... | stats max(_time) AS _time BY field | sort 0 - _time | head 1

View solution in original post

0 Karma

artrune
Path Finder

Thanks for your reply, I tried that but it didnt return anything.

0 Karma

artrune
Path Finder

Nevermind, this did work but i h ad to put my field inside double quotes. Thanks

0 Karma

woodcock
Esteemed Legend

Field names with spaces are evil.

0 Karma

artrune
Path Finder

Hmm its funny, because it worked on the search (inside splunk) but when calling through the api im not getting any response. With the previous query i would get response on the API.
Do you have any idea?

0 Karma

artrune
Path Finder

Nevermind haha i was missing the double quotes inside my code. Just had to escape them.
Thanks for the help

0 Karma

Sukisen1981
Champion
|  stats latest(fieldname) by _time
| reverse

???

0 Karma

artrune
Path Finder

Thanks for your reply aswell, When trying this it returns a lot of time stamps and and values.
I want only the latest value for my field with its timestamp

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.