In a given graph, say,
[|inputlookup capacityQuarterOne.csv] in which I have a big table of [ host / used_mb ] for every different host.
The search runs for past x # of days (7 days, 30 days, 1 quarter, etc.).
How could I find the LAST point in the graph (final point) for each host in the table?
I just want to make sure it's less than max threshold cap, so I want to report the final point for every host in the graph.
I would highly appreciate any input from you Splucktians,
Thank you in advance,
Jack
Like this:
... | dedup host
Isn't dedup just omitting duplicating elements?
It works by keeping the latest example of the deduped fields. It does exactly what you are desiring: keep the most recent event for each host.