Latest time and the corresponding raw data

[prettysunshinez]

Hi,
Can anyone help me how to get the latest time of an event and its corresponding raw logs(_raw).
When i use stats latest(_time),values(_raw)..
I get the latest time but a consolidated list of raw logs.

[arjunpkishore5]

Hi @prettysunshinez

In your case, you don't need to use stats, all you need is this

index= "search_string" 
| head 1 

If you need this in a table format, just add | table _time, _raw to the end of your query

This will give you the latest record. Please try and let me know if this is what you were looking for. Please mark as answer if yes.

Cheers.

[rmmiller]

I think you want this instead:

stats latest(_time), latest(_raw)

Hope that helps!
rmmiller

[prettysunshinez]

Can someone help please

[arjunpkishore5]

Could you please elaborate or post the query ? Are you just trying to get the latest record in the index ?

[prettysunshinez]

I'm looking for the latest time and _raw data of a particular string.

index= "search_string" |stats latest(_time) as Latest,values(_raw)

In the result I'm getting the latest time but all the values of _raw instead of the latest one.