Last (last)

[ 1 Description ] [ 2 How does it work in the search window? ] [ 3 How does it work in LINQ? ]

Description

Returns the last value found in a specified column for each grouping occurrence. To determine the last value, Devo uses the eventdate time rather than the log time, that is, the date Devo receives it rather than the date it was generated.

If you want to exclude null values, you can use the Last not null (nnlast) operation.

How does it work in the search window?

Before being able to perform this operation, you have to group your data. Be aware that the columns used as arguments for the grouping operation will not be available to select as arguments for the aggregation operation.

After grouping the data, select Aggregation in the search window toolbar, then select the Last operation. You need to specify one argument:

Argument	Data type

Argument	Data type
Last of ^mandatory	Any

The data type of the aggregated values will be the same as the data type of the column used as argument.

You cannot repeat the Last operation to apply subsequent aggregations. Use the Maximum (max) operation instead to get the same result. Repeating the Last operation returns an error because it requires access to the eventdate field. However, this field isn't available for subsequent aggregations.

Example

In the siem.logtrust.web.activity table, we want to get the last IP address value in each 5-minute period. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we will perform the aggregation using the Last operation.

The arguments needed for the Last operation are:

Last of → clientIpAddress column

Click Aggregate function and you will see the following result:

How does it work in LINQ?

Group your data using the following structure:

group every server period by column1, column2...
every client period

Then, use select... as... to add the new column that will show the aggregated values. This is the syntax for the Last operation:

last(column)

See Build a query using LINQ to learn more about grouping and aggregating your data using the LINQ language.

Example

You can copy the following LINQ syntax and try the example above on the siem.logtrust.web.activity table:

from siem.logtrust.web.activity
group every 5m
  every 5m
  select last(type) as Last_type