mvfind for the last value

[pkashou]

It seems that mvfind will only return the index of the first matching value. I would like to return the index of the last matching value within an MV field. Thanks!

[pkashou]

I found the answer. I create a MV field for just the value I am interested in, determine the total count, and then return the value at the index of count-1.

eval txKV = mvfilter(match(kvPair, "tx_success")) |
eval txCount = mvcount(txKV) |
eval txTime = mvindex(txKV, txCount-1) |