I'm generating a table of event count (same events) but I want it to also return the timestamp of the last event. I can't figure out how to do it. Running stats count against timestamp will give me a single count for each timestamp.
timestamp,color,shape,count
?,blue,square,5
?,red,circle,15
?,yellow,triangle,12
Help?
... | stats count, latest(_time)
?
Thank you, Ayn!!!!!
Well then, stats count, latest(_time) by color,shape
I think I oversimplified my example. I have a few fields in there so there are a couple of eventtypes, actually.