Splunk Search

How to create a search to do a count on the latest event only?

jip31
Motivator

hi
I want to do a count the last event of a subsearch
I am doing "stats count last" but it doesnt works
what I have to do please? Something with _time?

`test` 
    [| inputlookup host.csv 
    | table host 
    | rename host as USERNAME ] 
| search Building = "X254" 
**| stats count last(Building)**
0 Karma

jacobpevans
Motivator

Try changing last to latest.

If that doesn't solve your problem, please provide additional information (sample data and sample desired output).

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/EventOrderFunctions

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

jip31
Motivator

I have tried with last or latest but it doesnt works
and its difficult to send sample because confidentiality...
What I tried to explain its when i execute the query below, I have just one USERNAME corresponding to building "X254"
but the stats count give 17 events because for this only USERNAME there is 17 events
what I need is to count only the last events so my stats count has to be = 1 instead = 17

`test` 
    [| inputlookup host.csv 
    | table host 
    | rename host as USERNAME ]  
| lookup toto.csv NAME as AP_NAME OUTPUT Building 
 | search Building="X254"
| stats count last(Building) as Building by USERNAME
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...