Synopsis

Used to display the last specified number of events resulting from a Simple Search, or the last specified number of summary table entries resulting from a Complex Search.

Syntax

^{last [number_of_results] for each [group]}

Required Arguments

^{number_of_results}

Syntax: <numeric>

Description: The number of last search results to display

Optional Arguments

for each group

Syntax: for each <column name>

Description: The column name on which the last specific number should display.

Description

When used immediately following a Simple Search query, returns the specified number of last events resulting from the search. When used immediately following a Complex Search query, returns the specified number of last entries from the summary table resulting from the search.

Examples

Example 1:

^{* in log.access | last 91}

Returns the last 91 events from access log.

Example 2:

^{http in log.iis log| max time-taken | group by c-ip | last 3}

Returns the max time-taken value from events in log.iis log having http in their column values, for the last three c-ip values only.

Example 3:

error in log.xpologlog | count | group by class, method | last 2 for each class

Returns the 2 methods that appeared least in each class in log.xpologlog log having error in their column values.

Example 4:

error in log.xpologlog | count | group by message | interval 1 hour | last 2 for each interval

Returns the 2 messages that appeared least in each 1-hour interval in log.xpologlog log having error in their column values.