Splunk Search

How to use tstats to show the last event and event time from 30 hosts (in lookup)?

kiran331
Builder

How to use tstats to show the last event and event time from 30 hosts (in lookup)? If I can't use tstats, is there any other way to do this? Any suggestions.

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

The tstats works on the indexed/metadata fields and _raw is not one of them so you would be able to get the last events timestamp and other metadata information using tstats but not the actual event. If that's OK, then try like this

| tstats max(_time) as latestTime WHERE index=* [| inputlookup yourHostLookup.csv | table host ] by host | convert ctime(latestTime)

If you want the last raw event as well, try this slower method.

index=*  [| inputlookup yourHostLookup.csv | table host ] | dedup host

View solution in original post

somesoni2
Revered Legend

The tstats works on the indexed/metadata fields and _raw is not one of them so you would be able to get the last events timestamp and other metadata information using tstats but not the actual event. If that's OK, then try like this

| tstats max(_time) as latestTime WHERE index=* [| inputlookup yourHostLookup.csv | table host ] by host | convert ctime(latestTime)

If you want the last raw event as well, try this slower method.

index=*  [| inputlookup yourHostLookup.csv | table host ] | dedup host

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!