Splunk Search

find the last time an event occurred by field

dilbert99
New Member

I have events with a field called template

I am trying to find all of the templates that have not been used in the last year.

To start this off I tried the following query (is there a better approach?)

stats max(_time) by template

This results in:

template max(_time)

template_a 1349269087.794

template_b 1349269000.234

How do I get the time to show in a human readable format?

Tags (1)
0 Karma

Ayn
Legend

If you do stats max(_time) as _time, the table module will be smart enough to convert _time to a human readable format for you. Otherwise, there's the option of using convert ctime(yourfield) or fieldformat yourfield=strftime(yourfield,"%+").

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...