On This Page

Home / Search/ Language Reference/ Functions/ Cribl Functions/findlastif

findlastif

The findlastif aggregation function returns the last observed value of Expression across the group for which Predicate evaluates to true.

Use this function with the summarize, eventstats, and timestats operators.

Syntax
​

    findlastif( Expression, Predicate )

Arguments
​

  • Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.
  • Predicate: Expression that will be used to filter rows.

Usage
​

To find a latest event with respect to the _time field, instead use findlatestif.

You can use findlastif after a sort or order operator when sorting by a non-time field. Once events are sorted, this function acts much like maxif.

Example
​

This example returns the birthday for all names that have more than 4 letters.

dataset=myDataset
| summarize findlastif(day_of_birth, strlen(name) > 4)