Hi All, Can anyone please help me on this ...
I am framing a SPL query to get list of hosts with their last eventtime.
SPL query:
| tstats max(_time) as latest where index=indexname by host ...
See more...
Hi All, Can anyone please help me on this ...
I am framing a SPL query to get list of hosts with their last eventtime.
SPL query:
| tstats max(_time) as latest where index=indexname by host | convert ctime(latest)
From this query, I am getting the list as expected, but with one bug. (If I have a host both in lower case & in upper case, I am getting 2 different entries)
Eg: host latest
HOSTNAME1 09/17/2024 15:27:49
hostname1 08/30/2024 15:27:00
hostname2 09/15/2024 15:27:49
HOSTNAME2 09/13/2024 15:27:49
From here, I have to get only one entry for a host along with latest time. (For hostname1, I should get 09/17/2024 15:27:49, similarly for hostname2 I should get 09/15/2024 15:27:49) I tried adding the command,
| eval host=upper(host), latest=max(latest) | dedup host
But it is not considering max of "latest", and it just showing the single row for each host with random value of "latest"
Can you please suggest me the better way to achieve this. thanks