How to use tstats to show the last event and event time from 30 hosts (in lookup)?

[kiran331]

How to use tstats to show the last event and event time from 30 hosts (in lookup)? If I can't use tstats, is there any other way to do this? Any suggestions.

[somesoni2 · Accepted solution]

The tstats works on the indexed/metadata fields and _raw is not one of them so you would be able to get the last events timestamp and other metadata information using tstats but not the actual event. If that's OK, then try like this

| tstats max(_time) as latestTime WHERE index=* [| inputlookup yourHostLookup.csv | table host ] by host | convert ctime(latestTime)

If you want the last raw event as well, try this slower method.

index=*  [| inputlookup yourHostLookup.csv | table host ] | dedup host