Splunk Search

find the last time an event occurred by field

dilbert99
New Member

I have events with a field called template

I am trying to find all of the templates that have not been used in the last year.

To start this off I tried the following query (is there a better approach?)

stats max(_time) by template

This results in:

template max(_time)

template_a 1349269087.794

template_b 1349269000.234

How do I get the time to show in a human readable format?

Tags (1)
0 Karma

Ayn
Legend

If you do stats max(_time) as _time, the table module will be smart enough to convert _time to a human readable format for you. Otherwise, there's the option of using convert ctime(yourfield) or fieldformat yourfield=strftime(yourfield,"%+").

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...