How to create a search to do a count on the latest event only?

[jip31]

hi
I want to do a count the last event of a subsearch
I am doing "stats count last" but it doesnt works
what I have to do please? Something with _time?

`test` 
    [| inputlookup host.csv 
    | table host 
    | rename host as USERNAME ] 
| search Building = "X254" 
**| stats count last(Building)**

[jacobpevans]

Try changing last to latest.

If that doesn't solve your problem, please provide additional information (sample data and sample desired output).

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/EventOrderFunctions

[jip31]

I have tried with last or latest but it doesnt works
and its difficult to send sample because confidentiality...
What I tried to explain its when i execute the query below, I have just one USERNAME corresponding to building "X254"
but the stats count give 17 events because for this only USERNAME there is 17 events
what I need is to count only the last events so my stats count has to be = 1 instead = 17

`test` 
    [| inputlookup host.csv 
    | table host 
    | rename host as USERNAME ]  
| lookup toto.csv NAME as AP_NAME OUTPUT Building 
 | search Building="X254"
| stats count last(Building) as Building by USERNAME