Splunk Search

mstats latest(_time) not working

simpkins1958
Contributor

I am not able to get the latest (or earliest) _time values using mstats.

| mstats sum(bytes) latest(_time)
where index=metrics_app_dest_survey by app_name

is returning:

alt text

0 Karma
1 Solution

simpkins1958
Contributor

Misunderstanding on my part. I thought we could get the earliest/latest time value. Now I see that latest()/earliest() are for the metric value not _time value.

In 7.2 there are new time functions latest_time() and earliest_time() that get the time values.

View solution in original post

simpkins1958
Contributor

Misunderstanding on my part. I thought we could get the earliest/latest time value. Now I see that latest()/earliest() are for the metric value not _time value.

In 7.2 there are new time functions latest_time() and earliest_time() that get the time values.

Vijeta
Influencer

You can get latest(_time), the screenshot you shared shows latest(time) as column name. It should be latest(_time) unless you are renaming _time to time

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...