Splunk Search

How to create the table based on the specific time from latest(_time)?

Splunker4
Observer

I was trying to get the latest time from index=index1 sourcetype=source1

Below is the string:

 | tstats latest(_time) as lastTime where index=index1 sourcetype=source1 | eval lastTime=strftime(lastTime,"%x %X")

I will use this lastTime as the time-picker to have the table display for data inside source1. The purpose is to always get the data from last time query log in source1. Could anybody to tell me how to continue the string to make it?

Labels (3)
Tags (2)
0 Karma

woodcock
Esteemed Legend
 | tstats max(_time) AS _time
where index=index1 sourcetype=source1
| eval Time = _time
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you clarify the use case here?  If you want data from the last entry in source1 - which would be the latest for the vast majority of sources, wouldn't it be easier to simply "tail 1"?  The phrase "time-picker" can be interpreted as an input on a dashboard.  If that is the case, your search serves the purpose already. (Although using a string for time-related input usually does not end well.)

If the source's time in the index is somehow scrambled, and you want to select the latest event, you can sort, then tail. "| sort _time | tail 1".  (Sorting raw events is expensive.  But I don't see a clean way out if index is already scrambled.)

Also note that latest(_time) is more expensive than max(_time).

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...