I wonder what the difference between last and max in timestamp if I want to return the most recent time from a lookup. Both of them return the same result as showed below. Any comments?
| makeresults
| eval last_seen=strptime("05/06/2019 5:43:32","%m/%d/%Y %H:%M:%S")
| append
[| makeresults
| eval last_seen=strptime("05/06/2019 16:12:00","%m/%d/%Y %H:%M:%S")]
| stats max(last_seen) as max_last_seen last(last_seen) as first_last_seen
| eval max_last_seen=strftime(max_last_seen, "%m/%d/%Y %H:%M:%S"), first_last_seen=strftime(first_last_seen, "%m/%d/%Y %H:%M:%S")
Using max(_time)
is far more efficient than using latest(_time)
because it does less work. One should ALWAYS use max(_time)
over latest(_time)
.
Using max(_time)
is far more efficient than using latest(_time)
because it does less work. One should ALWAYS use max(_time)
over latest(_time)
.
Furthermore, if you are POSITIVE that you results will ALWAYS be sorted (keep in mind that in low-RAM situations, sometimes events are not returned fully sorted), you can use first(_time)
which is the fastest and most-efficient of them all.