- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

simpkins1958
Contributor
10-11-2018
09:02 AM
I am not able to get the latest (or earliest) _time values using mstats.
| mstats sum(bytes) latest(_time)
where index=metrics_app_dest_survey by app_name
is returning:
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

simpkins1958
Contributor
10-11-2018
09:15 AM
Misunderstanding on my part. I thought we could get the earliest/latest time value. Now I see that latest()/earliest() are for the metric value not _time value.
In 7.2 there are new time functions latest_time() and earliest_time() that get the time values.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

simpkins1958
Contributor
10-11-2018
09:15 AM
Misunderstanding on my part. I thought we could get the earliest/latest time value. Now I see that latest()/earliest() are for the metric value not _time value.
In 7.2 there are new time functions latest_time() and earliest_time() that get the time values.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Vijeta
Influencer
10-11-2018
09:23 AM
You can get latest(_time), the screenshot you shared shows latest(time) as column name. It should be latest(_time) unless you are renaming _time to time
