Splunk Search

How can I show the time of the last event in a stats by count table?

draracle
Engager

I have a table that shows the host name, IP address, Virus Signature, and Total Count of events for a given period of time. I would like to add a field for the last related event. The results would look similar to below (truncated for brevity):

Last_Event           Host_Name     Count
9/14/2016 1:30PM     ABC123        50
9/14/2016 1:30PM     DEF432        3

Appreciate the help,
Thanks,

0 Karma
1 Solution

twinspop
Influencer
... | stats c as Count latest(_time) as _time by Host_Name

View solution in original post

twinspop
Influencer
... | stats c as Count latest(_time) as _time by Host_Name

draracle
Engager

Thanks -- the latest time is appearing and with the total count of events! The last thing I needed was changing the order of the fields and that was done by adding ..| table "_time","Count","Host_Name","etc.."

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...