Using latest timestamp in another search

[krylov]

Good afternoon!

I need to do the following:
1. Using a search result that finds the last timestamp in a certain time interval, add it to another search № 2
index=status beamID=1 | stats latest(statustime)
2. Real-time search:
index = status beamID=1 time = "result of search №1" |
stats count(eval(terminalStatus="normal")) as NORMAL count(eval(terminalStatus="critical")) as CRITICAL count(eval(terminalStatus="pending-registration")) as PENDING-REGISTRATION count(eval(terminalStatus="unknown")) as UNKNOWN count(eval(terminalStatus="minor")) as MINOR count(eval(terminalStatus="major")) as MAJOR count(eval(terminalStatus="activationFailed")) as ACTIVATIONFAILED by beamID

Is it possible to do this?
Thanks in advance!

[richgalloway · Accepted solution]

Use a subsearch.

index = status beamID=1 time = [ index=status beamID=1 | stats latest(statustime) as latest | return $latest ] |
stats count(eval(terminalStatus="normal")) as NORMAL count(eval(terminalStatus="critical")) as CRITICAL count(eval(terminalStatus="pending-registration")) as PENDING-REGISTRATION count(eval(terminalStatus="unknown")) as UNKNOWN count(eval(terminalStatus="minor")) as MINOR count(eval(terminalStatus="major")) as MAJOR count(eval(terminalStatus="activationFailed")) as ACTIVATIONFAILED by beamID

[krylov]

Thanks! It really works.

[richgalloway]

@krylov If your problem is resolved, please accept the answer to help future readers.