Hi @brpsingara
| metadata type=hosts index=_internal
| rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update"
| fieldformat Count=tostring(Count, "commas")
| fieldformat "First Event"=strftime('First Event', "%c")
| fieldformat "Last Event"=strftime('Last Event', "%c")
| fieldformat "Last Update"=strftime('Last Update', "%c")
This sample search is basically just taken on the official docs Search Reference.
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Metadata
Hope it helps!
... View more