Splunk Search

How to display a latest time or last received time from a custom time field.

inayath_khanin
Observer

Hi Folks,

 

I am been trying to display latest time results. I have a logs where time stores under a custom field (Patch_date) and i want to display latest time result. I tried below but that doesn't worked,

base search |search Patch_date=latest(Patch_date) |table Patch_date,region,server,os_type,location

base search |search Patch_date=latest($Patch_date$) |table Patch_date,region,server,os_type,location

but unfortunately both dint worked. 

 

Please support on achieving the required.

 

Thanks 

 

Labels (2)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please describe what "doesn't work" means in this case. What were the expected results? What were the actual results?
What is the format of the Patch_date field?
The latest function cannot be used in the search command. Latest can be used in where or eval.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

rnowitzki
Builder

Hi @inayath_khanin ,

Can you please share the format/an example of "patch_date"?

You probably have to transform it to a date field in order to work with it. I assume it is treated as a string.

Check strptime() :
https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/DateandTimeFunctions

BR
Ralph


--
Karma and/or Solution tagging appreciated.
0 Karma

inayath_khanin
Observer

@rnowitzki  Thanks for the reply. 2020-03-12 12:03:54 , This is the format. 

Do we have any command or way which calls latest value?

0 Karma

rnowitzki
Builder

Hi @inayath_khanin ,

As "latest" is working against the _time field, you will have to work with max()
And before that, convert the patch_date to epoch:

base search 
| eval patch_date_epoch=strptime(patch_date,"%Y-%m-%d %H:%M:%S")
| stats max(patch_date_epoch) as patch_date_epoch by patch_date,region,server,os_type,location
| fields - patch_date_epoch

 

Hope it works.

BR

Ralph

--
Karma and/or Solution Tagging appreciated.

 

--
Karma and/or Solution tagging appreciated.
0 Karma