It is easy and fast to get the last event logged by a particular host using metadata, but has anyone concocted an efficient way to find the most recent event matching a particular eventtype or query by host?
Other than
eventtype=myeventtype host=myhost | head 1
I can't think of a better or more efficient way. If you need the most recent one for every host, I would look into using the map
command.
Other than
eventtype=myeventtype host=myhost | head 1
I can't think of a better or more efficient way. If you need the most recent one for every host, I would look into using the map
command.
depends how many hosts, how many events, how the events from each host are interleaved.
I think map may work, but it's certainly not efficient, and gives no indication of progress. In Jobs, you simply see "subsearch" for each search that it runs.
|metadata type=hosts | fields host | map maxsearches=10000 search="search eventtype=foo host=$host$ | head 1" | fields _time host
It may simply be more efficient to search for the eventtype over all time and use stats max(_time) by host.