Hi @sukansingh, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉
... View more
If it is always the last / latest column, you could try something like this | sort 0
[| makeresults
| addinfo
| eval search=strftime(info_max_time-1, "%F")
| fields search
| format "" "" "" "" "" ""]
... View more
Please post this as a new question rather than asking a different variant of another question on an 8 year old answer question. It will get more attention.
... View more