hi
I want to do a count the last event of a subsearch
I am doing "stats count last" but it doesnt works
what I have to do please? Something with _time?
`test`
[| inputlookup host.csv
| table host
| rename host as USERNAME ]
| search Building = "X254"
**| stats count last(Building)**
Try changing last
to latest
.
If that doesn't solve your problem, please provide additional information (sample data and sample desired output).
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/EventOrderFunctions
I have tried with last or latest but it doesnt works
and its difficult to send sample because confidentiality...
What I tried to explain its when i execute the query below, I have just one USERNAME corresponding to building "X254"
but the stats count give 17 events because for this only USERNAME there is 17 events
what I need is to count only the last events so my stats count has to be = 1 instead = 17
`test`
[| inputlookup host.csv
| table host
| rename host as USERNAME ]
| lookup toto.csv NAME as AP_NAME OUTPUT Building
| search Building="X254"
| stats count last(Building) as Building by USERNAME