Getting Time of last occurrence of a sbstring

[siddharthmis]

I have events like below in a log file-

06/18/2017 22:35:10,Message="Finished Cleanup"
06/18/2017 22:57:02,Message="Finished Cleanup"
06/18/2017 22:57:02,Message="Finished Cleanup"

I want to extract (only) the time "06/18/2017 22:57" i.e. the time of last occurrence.

I used-

source="**"  Message="Finished Cleanup" |  stats max(_time) as time by Message  | eval End_Time=strftime(time,"%m/%d/%Y %H:%M")

But stats is not helping as I only want the time stamp.
How can I get time stamp only.

[inventsekar]

Hi siddharthmis, may we know if this is working fine now? can you please mark this as completed

[inventsekar]

maybe, try - tail 1 --- to get the oldest event and then a rex to extract the timestamp.

( "tail 1" worked the opposite way around, replace it with "head 1" )

source="**" Message="Finished Cleanup" | tail 1 | rex field=_raw "^(?<DateTime>\d+\/\d+\/\d+\s+\d+:\d+:\d+)" | table DateTime _raw

[dineshraj9]

You are filtering out based on the Message field, so you don't need to use it with stats command -

 source="**"  Message="Finished Cleanup" |  stats max(_time) as time | eval End_Time=strftime(time,"%m/%d/%Y %T")

Also you are filter fields using the fields command.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Fields