Splunk Search

get latest value and timestamp

a212830
Champion

Hi,

How would I go about getting the latest value of a search, along with the timestamp of that search? I want to include it in a table.

Tags (2)

stoomart
Explorer

I've found the stat functions 'earliest' and 'latest' work best for time-dependent field reporting:

... | stats latest(_time) as _time, latest(X)

a212830
Champion

Sorry that I wasn't more specific. I want to grab data from the previous hour, and I want to get the value of the last event, along with the timestamp associated with that last event. I'll try these, but I'm don't think they are what I'm looking for...

0 Karma

Paolo_Prigione
Builder

I think you are looking for:

| head 1
| addinfo

The time the search was executed will be in the info_search_time field

sbrant_splunk
Splunk Employee
Splunk Employee

You can also get the most recent value of a particular field using the "first" function in stats:

... | stats first(X)

martin_mueller
SplunkTrust
SplunkTrust

This would get you the latest result:

... | head 1

Not sure if that's what you want, hard to guess from the question.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...