Splunk Search

How to use tstats to show the last event and event time from 30 hosts (in lookup)?

Builder

How to use tstats to show the last event and event time from 30 hosts (in lookup)? If I can't use tstats, is there any other way to do this? Any suggestions.

Tags (3)
0 Karma
1 Solution

Revered Legend

The tstats works on the indexed/metadata fields and _raw is not one of them so you would be able to get the last events timestamp and other metadata information using tstats but not the actual event. If that's OK, then try like this

| tstats max(_time) as latestTime WHERE index=* [| inputlookup yourHostLookup.csv | table host ] by host | convert ctime(latestTime)

If you want the last raw event as well, try this slower method.

index=*  [| inputlookup yourHostLookup.csv | table host ] | dedup host

View solution in original post

Revered Legend

The tstats works on the indexed/metadata fields and _raw is not one of them so you would be able to get the last events timestamp and other metadata information using tstats but not the actual event. If that's OK, then try like this

| tstats max(_time) as latestTime WHERE index=* [| inputlookup yourHostLookup.csv | table host ] by host | convert ctime(latestTime)

If you want the last raw event as well, try this slower method.

index=*  [| inputlookup yourHostLookup.csv | table host ] | dedup host

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!