Splunk Search

Most efficient to find most recent eventtype by host

Contributor

It is easy and fast to get the last event logged by a particular host using metadata, but has anyone concocted an efficient way to find the most recent event matching a particular eventtype or query by host?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Other than

eventtype=myeventtype host=myhost | head 1

I can't think of a better or more efficient way. If you need the most recent one for every host, I would look into using the map command.

View solution in original post

Splunk Employee
Splunk Employee

Other than

eventtype=myeventtype host=myhost | head 1

I can't think of a better or more efficient way. If you need the most recent one for every host, I would look into using the map command.

View solution in original post

Splunk Employee
Splunk Employee

depends how many hosts, how many events, how the events from each host are interleaved.

0 Karma

Contributor

I think map may work, but it's certainly not efficient, and gives no indication of progress. In Jobs, you simply see "subsearch" for each search that it runs.

|metadata type=hosts | fields host | map maxsearches=10000 search="search eventtype=foo host=$host$ | head 1" | fields _time host

It may simply be more efficient to search for the eventtype over all time and use stats max(_time) by host.

0 Karma