Splunk Search

What is the best approach for calculating a count and showing the most recent occurrence timestamp?

mumblingsages
Path Finder

Given data like:

_time, lastname

How would I do a count of lastname and display the most recent _time for that lastname on the same row of a results table?

--Mark

Tags (2)
0 Karma

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| stats count max(_time) latest(_raw) BY lastname
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@mumblingsages ,

Try,

"your base search" |stats count , latest(_time) by lastname
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!