Most efficient to find most recent eventtype by host

[vbumgarner]

It is easy and fast to get the last event logged by a particular host using metadata, but has anyone concocted an efficient way to find the most recent event matching a particular eventtype or query by host?

[gkanapathy · Accepted solution]

Other than

eventtype=myeventtype host=myhost | head 1

I can't think of a better or more efficient way. If you need the most recent one for every host, I would look into using the map command.

[gkanapathy]

depends how many hosts, how many events, how the events from each host are interleaved.

[vbumgarner]

I think map may work, but it's certainly not efficient, and gives no indication of progress. In Jobs, you simply see "subsearch" for each search that it runs.

|metadata type=hosts | fields host | map maxsearches=10000 search="search eventtype=foo host=$host$ | head 1" | fields _time host

It may simply be more efficient to search for the eventtype over all time and use stats max(_time) by host.