Hello
From the search, I get the IP's and its last scan information with LAST_SCAN_DATETIME. I need to get the information based on the last scan date.
From the actual index:
index=qualys | search IP=10.2.2.3
Output fields :
LAST_SCAN_DATETIME
2016-11-04T08:16:32Z (count 55)
2016-10-03T08:16:32Z (count 22)
How can I change the search to show only one last field value for LAST_SCAN_DATETIME for each IP?
Search I'm using:
index=qualys|head 1 LAST_SCAN_DATETIME|table IP .....
Either of the two should do the trick I'd think:
index=qualys | top limit=1 LAST_SCAN_DATETIME by IP
OR
index=qualys | stats latest(LAST_SCAN_DATETIME) by IP
When I did the search
index=qualys| | stats latest(LAST_SCAN_DATETIME) as Last_scan by IP,QID, HOST_ID, DNS, OS,STATUS
its showing all results, I need the results for only one LAST_SCAN_DATETIME.
When it show "all" results it seams you have in one or more 'by' fields differences.
Put everything expect IP in latest() in front of the 'by' and this should be what you are searching for.
Is there a way to limit only one field value in a field LAST_SCAN_DATETIME?