system-table-last-logs

Retrieves the most recently ingested record for each table.

Command properties

Property	Description
Command type	Driver query
Required permission	None
License usage	Not counted
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

system-table-last-logs [table=TABLE_PATTERN]

Options

table=TABLE_PATTERN: Specifies the list of tables to query. Separate multiple tables with a comma (,). Wildcards (*) can be used at the beginning or end of a name. If not specified, all tables for which the user has read permission are queried.

Output fields

Field	Type	Description
table_name	string	Table name
date	timestamp	Timestamp of the most recently ingested record
data	map	Content of the most recently ingested record

Error codes

Parsing errors

N/A

Runtime errors

N/A

Description

The system-table-last-logs command retrieves the most recently ingested record for each table. If a table has no data or the latest partition cannot be retrieved, the date and data fields return null.

Tables for which the user does not have read permission are excluded. Administrators can query all tables.

Examples

Retrieve the latest record for all tables
```
system-table-last-logs
```
Retrieves the most recently ingested record for all tables the user has read permission for.
Retrieve the latest record for a specific table
```
system-table-last-logs table=my_table
```
Retrieves the most recently ingested record from the my_table table.

Detect tables with stale data

system-table-last-logs
| search isnotnull(date)
| eval hours_ago = datediff(now(), date, "h")
| search hours_ago > 24
| sort -hours_ago

Retrieves tables that have not received data within the last 24 hours.