last()

Returns the last non-null value encountered in a group.

Syntax

last(EXPR)

Parameters

EXPR: An expression that returns the field from which to extract the last value.

Description

The last() function processes records in a group in order and replaces its internally stored value each time EXPR returns a non-null value. As a result, the last non-null value to appear in the group remains.

When aggregation is complete, the function returns the last recorded value as-is. The return type follows the type of EXPR. If there are no valid values in the group, it returns null.

This function can only be used in aggregation commands such as stats and timechart.

Error codes

Code	Description
91020	The number of arguments is wrong.

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

Extract the last requested URI per source IP address

table WEB_APACHE_SAMPLE | stats last(uri) by src_ip

Extract the response size of the last request per HTTP method
```
table WEB_APACHE_SAMPLE | stats last(bytes) by method
```

Null value handling

json "[{'val': 10}, {'val': null}, {'val': null}]"
| stats last(val)
| # last(val): 10

Compatibility

The last() function has been available since before Logpresso Sonar 4.0.