Hi Folks,
I am been trying to display latest time results. I have a logs where time stores under a custom field (Patch_date) and i want to display latest time result. I tried below but that doesn't worked,
base search |search Patch_date=latest(Patch_date) |table Patch_date,region,server,os_type,location
base search |search Patch_date=latest($Patch_date$) |table Patch_date,region,server,os_type,location
but unfortunately both dint worked.
Please support on achieving the required.
Thanks
Please describe what "doesn't work" means in this case. What were the expected results? What were the actual results?
What is the format of the Patch_date field?
The latest function cannot be used in the search command. Latest can be used in where or eval.
Hi @inayath_khanin ,
Can you please share the format/an example of "patch_date"?
You probably have to transform it to a date field in order to work with it. I assume it is treated as a string.
Check strptime() :
https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/DateandTimeFunctions
BR
Ralph
@rnowitzki Thanks for the reply. 2020-03-12 12:03:54 , This is the format.
Do we have any command or way which calls latest value?
Hi @inayath_khanin ,
As "latest" is working against the _time field, you will have to work with max()
And before that, convert the patch_date to epoch:
base search
| eval patch_date_epoch=strptime(patch_date,"%Y-%m-%d %H:%M:%S")
| stats max(patch_date_epoch) as patch_date_epoch by patch_date,region,server,os_type,location
| fields - patch_date_epoch
Hope it works.
BR
Ralph
--
Karma and/or Solution Tagging appreciated.