How to edit my search to show only the last field value from a field for each IP?

[kiran331]

Hello

From the search, I get the IP's and its last scan information with LAST_SCAN_DATETIME. I need to get the information based on the last scan date.

From the actual index:

index=qualys | search IP=10.2.2.3

Output fields :

LAST_SCAN_DATETIME
2016-11-04T08:16:32Z  (count 55)
2016-10-03T08:16:32Z  (count 22)

How can I change the search to show only one last field value for LAST_SCAN_DATETIME for each IP?

Search I'm using:

index=qualys|head 1 LAST_SCAN_DATETIME|table IP .....

[goodsellt]

Either of the two should do the trick I'd think:

index=qualys | top limit=1 LAST_SCAN_DATETIME by IP

OR

index=qualys | stats latest(LAST_SCAN_DATETIME) by IP

[kiran331]

When I did the search

index=qualys| | stats latest(LAST_SCAN_DATETIME) as Last_scan by IP,QID, HOST_ID, DNS, OS,STATUS

its showing all results, I need the results for only one LAST_SCAN_DATETIME.

[DarthDMader]

When it show "all" results it seams you have in one or more 'by' fields differences.
Put everything expect IP in latest() in front of the 'by' and this should be what you are searching for.

[kiran331]

Is there a way to limit only one field value in a field LAST_SCAN_DATETIME?