How to add the latest time of laptop communication to another column in a CSV file?

[Nayakstar]

I have a list of Laptop names in one column of a CSV file and I want to add the latest time of its communication in another column. In my Splunk logs, one field is "laptop" and other one is "_time".

Please suggest any solution.

[DalJeanis]

It's going to look something like this -

index=laptopindex "put search criteria here for the laptop info events"
| fields _time laptop
| stats max(_time) as Last_Time by laptop
| rename laptop as Laptop
| eval Last_Time= strftime(Last_Time,"%Y-%m-%d %H:%M:%S")
| inputlookup append=T  mylaptoptracking.csv 
| table Laptop last_time
| outputlookup mylaptoptracking.csv 

This accounts for the two fields you asked for, which I've assumed in the csv are called Laptop and Last_Time.

You might want to change the reformatting of the Last_Time field to whatever format you want the csv to store the date/time in.

[somesoni2 · Accepted solution]

Try something like this

your splunk log search giving field laptop and _time | stats max(_time) as recentTime by laptop
| append [| inputlookup yourlaptoplookup.csv | table laptop recentTime ] 
| stats max(_time) as recentTime by laptop | outputlookup append=f yourlaptoplookup.csv 

[DalJeanis]

Slightly different from mine, but this should work, depending on the spelling and capitalization of the field names in the csv file.

The OP should be careful that at the point immediately before the append, either when using somesoni2's method or mine, that the fields are spelled and capitalized exactly the way they are in the csv, for the remainder of the search code. Before that point, they should be named and spelled however they are on the events.