I have a search/dash board that will show data over the last 30 days, the search is as followed
index=server EventCode=5829
| stats count by ComputerName, Domain, Machine_SamAccountName, Machine_Operating_System
this search will give me roughly 70~ events a month, the problem is now my customer would like to have the time stamp put on the table, (which is easy by putting just the "_time" field in there) my problem that I am running into is that it will give me 10,000 results now! I showed the customer this and they said it would be fine for me to show just the latest event in the last 30 days for each Machine_SamAccountName.
My question is how????
