Hi
is there a way to do this?
Basically, I want to run the following search, but have the "earliest" as variable depeding on the last indexttime.
index=sam earliest=07/1/2013:13:00:00 | stats latest(_time) AS latest_time | convert ctime(latest_time)
Any help would be much appreciated.
Best regards Mike