How to display a latest time or last received time from a custom time field.

[inayath_khanin]

Hi Folks,

I am been trying to display latest time results. I have a logs where time stores under a custom field (Patch_date) and i want to display latest time result. I tried below but that doesn't worked,

base search |search Patch_date=latest(Patch_date) |table Patch_date,region,server,os_type,location

base search |search Patch_date=latest($Patch_date$) |table Patch_date,region,server,os_type,location

but unfortunately both dint worked. 

Please support on achieving the required.

Thanks 

[richgalloway]

Please describe what "doesn't work" means in this case. What were the expected results? What were the actual results?
What is the format of the Patch_date field?
The latest function cannot be used in the search command. Latest can be used in where or eval.

[rnowitzki]

Hi @inayath_khanin ,

Can you please share the format/an example of "patch_date"?

You probably have to transform it to a date field in order to work with it. I assume it is treated as a string.

Check strptime() :
https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/DateandTimeFunctions

BR
Ralph

[inayath_khanin]

@rnowitzki  Thanks for the reply. 2020-03-12 12:03:54 , This is the format. 

Do we have any command or way which calls latest value?

[rnowitzki]

Hi @inayath_khanin ,

As "latest" is working against the _time field, you will have to work with max()
And before that, convert the patch_date to epoch:

base search 
| eval patch_date_epoch=strptime(patch_date,"%Y-%m-%d %H:%M:%S")
| stats max(patch_date_epoch) as patch_date_epoch by patch_date,region,server,os_type,location
| fields - patch_date_epoch

Hope it works.

BR

Ralph

--
Karma and/or Solution Tagging appreciated.