Hi,
Any idea how to get the result set of the last sample without using head. Let's say we have a summary index with the following log set:
time_1 G=1 orig_host=a
time_1 G=1 orig_host=b
time_1 G=3 orig_host=c
time_2 G=3 orig_host=a
time_2 G=2 orig_host=b
time_2 G=3 orig_host=c
Using the search command "head" I can get my last sample if I know the number of logs per sample. For example:
sourcetype=x|head 3|table _time orig_Host G
How can I get the same result set without using the head search command?
Thanks,
Lp
I think you could probably modify the following answer:
http://splunk-base.splunk.com/answers/52891/most-recent-event-from-each-source
Just change to | metadata type=hosts since you want to look up data based on a host.
I modified the question to clarify the scenario. I tried the example you sent me before I could not make it work. Any idea.
Lp