Splunk Search

Give me a count of all events but give me the date of the last event?

the_wolverine
Champion

I'm generating a table of event count (same events) but I want it to also return the timestamp of the last event. I can't figure out how to do it. Running stats count against timestamp will give me a single count for each timestamp.

timestamp,color,shape,count
?,blue,square,5
?,red,circle,15
?,yellow,triangle,12

Help?

0 Karma
1 Solution

Ayn
Legend
... | stats count, latest(_time)

?

View solution in original post

Ayn
Legend
... | stats count, latest(_time)

?

the_wolverine
Champion

Thank you, Ayn!!!!!

0 Karma

Ayn
Legend

Well then, stats count, latest(_time) by color,shape

the_wolverine
Champion

I think I oversimplified my example. I have a few fields in there so there are a couple of eventtypes, actually.

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...