find the last time an event occurred by field

[dilbert99]

I have events with a field called template

I am trying to find all of the templates that have not been used in the last year.

To start this off I tried the following query (is there a better approach?)

stats max(_time) by template

This results in:

template max(_time)

template_a 1349269087.794

template_b 1349269000.234

How do I get the time to show in a human readable format?

[Ayn]

If you do stats max(_time) as _time, the table module will be smart enough to convert _time to a human readable format for you. Otherwise, there's the option of using convert ctime(yourfield) or fieldformat yourfield=strftime(yourfield,"%+").