Splunk Search

How can I list out values of the top 2 (latest 2)Time stamps

New Member

Date1 Host Path1
Date2 Host Path2
Date 3 Host Path3

I need to table out the latest Host, latest 2 dates, and the corresponding 2 paths
Please help!!

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Try this (assuming Date is in epoch format OR using _time field).

your current search giving fields DateField HostField PathFIeld
| sort 2 -DateField

If Date is not in epoch format (or not using _time), convert to epoch and do sort

your current search giving fields DateField HostField PathFIeld | eval sortfield=strptime(DateField,"<<DateFormatHere>>")
| sort 2 -sortfield
0 Karma