Splunk Search

Last event grouped by

oscargarcia
Path Finder

Hi,

I am building an app for managing some network switches. One of the views I want to create has the same data list:

For a given period of time, grouped by host, the date of the last event that matches certain criteria.

I can do that easily with "| tail 1", but that only covers one host or query. With the stats command, I can easily find the number of events matched grouped by host, but I am struggling to find the last one only for every host.

Any ideas?

Many thanks!

1 Solution

mw
Splunk Employee
Splunk Employee

How about:

... | stats last(_raw) by host

View solution in original post

mw
Splunk Employee
Splunk Employee

How about:

... | stats last(_raw) by host

Ayn
Legend

dedup host

0 Karma

YisroelB
Explorer

It seems that once you do this you lose access to the fields and would have to parse it out manually. For example if you pipe the above to "| table _time" _time is empty. Any way around this?

0 Karma

oscargarcia
Path Finder

so elegant... I love it... thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...