I have 3 indexes that get updated with the same date. They are all a snapshot of pre production config data that gets updated twice per day. Running the following gives me the last date:
index=* Date < a | stats max(Date)
But if I try to run the following it doesn't return anything:
index=* [search index=* Date < a | stats max(Date)] | stats count by index,Date
What Am I missing?
The < a is because some data in the Date field gets wrongly created using the column header "Date"
Ok, found the answer
index=* [search index=* Date < a | stats max(Date) as Date] | stats count by index,Date
As Date solved the issue...
View solution in original post