findlast ​

The findlast aggregation function returns the last observed non-null value of Expression across the group.

Use this function with the summarize, eventstats, and timestats operators.

Syntax ​

findlast( Expression )

Arguments ​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.

Usage ​

To find a latest event with respect to the _time field, instead use findlatest.

When events are sorted with sort or order, findlast returns the last non-null value of Expression in that sort order.

When events are not sorted, findlast returns an arbitrary non-null value. Use take_any when sort order does not matter.

Examples ​

Here is a basic example:

dataset=myDataset
| summarize findlast(channel)

This example effectively finds min(status) and max(status):

dataset="cribl_internal_logs" status=/[0-9]+/ 
| order by status asc 
| summarize x = findfirst(status), y = findlast(status)