Splunk Search

How to edit my search to show only the last field value from a field for each IP?

kiran331
Builder

Hello

From the search, I get the IP's and its last scan information with LAST_SCAN_DATETIME. I need to get the information based on the last scan date.

From the actual index:

index=qualys | search IP=10.2.2.3

Output fields :

LAST_SCAN_DATETIME
2016-11-04T08:16:32Z  (count 55)
2016-10-03T08:16:32Z  (count 22)

How can I change the search to show only one last field value for LAST_SCAN_DATETIME for each IP?

Search I'm using:

index=qualys|head 1 LAST_SCAN_DATETIME|table IP .....
Tags (1)
0 Karma

goodsellt
Contributor

Either of the two should do the trick I'd think:

index=qualys | top limit=1 LAST_SCAN_DATETIME by IP

OR

index=qualys | stats latest(LAST_SCAN_DATETIME) by IP

0 Karma

kiran331
Builder

When I did the search

index=qualys| | stats latest(LAST_SCAN_DATETIME) as Last_scan by IP,QID, HOST_ID, DNS, OS,STATUS

its showing all results, I need the results for only one LAST_SCAN_DATETIME.

0 Karma

DarthDMader
Explorer

When it show "all" results it seams you have in one or more 'by' fields differences.
Put everything expect IP in latest() in front of the 'by' and this should be what you are searching for.

0 Karma

kiran331
Builder

Is there a way to limit only one field value in a field LAST_SCAN_DATETIME?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...