Splunk Search

How can I show the time of the last event in a stats by count table?

draracle
Engager

I have a table that shows the host name, IP address, Virus Signature, and Total Count of events for a given period of time. I would like to add a field for the last related event. The results would look similar to below (truncated for brevity):

Last_Event           Host_Name     Count
9/14/2016 1:30PM     ABC123        50
9/14/2016 1:30PM     DEF432        3

Appreciate the help,
Thanks,

0 Karma
1 Solution

twinspop
Influencer
... | stats c as Count latest(_time) as _time by Host_Name

View solution in original post

twinspop
Influencer
... | stats c as Count latest(_time) as _time by Host_Name

draracle
Engager

Thanks -- the latest time is appearing and with the total count of events! The last thing I needed was changing the order of the fields and that was done by adding ..| table "_time","Count","Host_Name","etc.."

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...