Splunk Search

How to use tstats to show the last event and event time from 30 hosts (in lookup)?

Builder

How to use tstats to show the last event and event time from 30 hosts (in lookup)? If I can't use tstats, is there any other way to do this? Any suggestions.

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

The tstats works on the indexed/metadata fields and _raw is not one of them so you would be able to get the last events timestamp and other metadata information using tstats but not the actual event. If that's OK, then try like this

| tstats max(_time) as latestTime WHERE index=* [| inputlookup yourHostLookup.csv | table host ] by host | convert ctime(latestTime)

If you want the last raw event as well, try this slower method.

index=*  [| inputlookup yourHostLookup.csv | table host ] | dedup host

View solution in original post

SplunkTrust
SplunkTrust

The tstats works on the indexed/metadata fields and _raw is not one of them so you would be able to get the last events timestamp and other metadata information using tstats but not the actual event. If that's OK, then try like this

| tstats max(_time) as latestTime WHERE index=* [| inputlookup yourHostLookup.csv | table host ] by host | convert ctime(latestTime)

If you want the last raw event as well, try this slower method.

index=*  [| inputlookup yourHostLookup.csv | table host ] | dedup host

View solution in original post