https://community.splunk.com/t5/Getting-Data-In/How-do-I-only-see-the-latest-data-from-a-dynamically-changing/m-p/218739#M42990 <P>You can use:</P> <PRE><CODE>... | sort - _indextime | dedup DATE HOUR WORKFILE_COUNT </CODE></PRE> Wed, 04 Nov 2015 15:29:40 GMT woodcock 2015-11-04T15:29:40Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-only-see-the-latest-data-from-a-dynamically-changing/m-p/218738#M42989 <P>I have a customer's CSV file that is dynamically updated. By that' what i mean is that the last row is sometimes deleted and readded with updated information:</P> <PRE><CODE>DATE,HOUR,WORKFILE_COUNT,RATE_PER_WORKFILE,EST_NBR_WORKFILES_PER_HOUR,WORK_HOLD_FILE_COUNT,WORK_DONE_FILE_COUNT,UNPROCESSED_FILE_COUNT,BAD_FILE_COUNT 09/13/15,15,1172,247.238,14560.9,0,0,0,13 09/13/15,16,1190,247.011,14574.3,0,0,0,13 09/13/15,17,1217,227.313,15837.2,0,0,0,13 09/13/15,18,782,231.839,15528,0,0,0,13 09/13/15,19,648,240.61,14962,0,0,0,13 09/13/15,20,629,238.669,15083.6,0,0,0,13 09/13/15,21,394,242.297,14857.8,0,0,0,13 09/13/15,22,493,295.181,12195.9,0,0,0,13 09/13/15,23,257,280.949,12813.7,0,0,0,13 </CODE></PRE> <P>May change to:</P> <PRE><CODE>DATE,HOUR,WORKFILE_COUNT,RATE_PER_WORKFILE,EST_NBR_WORKFILES_PER_HOUR,WORK_HOLD_FILE_COUNT,WORK_DONE_FILE_COUNT,UNPROCESSED_FILE_COUNT,BAD_FILE_COUNT 09/13/15,15,1172,247.238,14560.9,0,0,0,13 09/13/15,16,1190,247.011,14574.3,0,0,0,13 09/13/15,17,1217,227.313,15837.2,0,0,0,13 09/13/15,18,782,231.839,15528,0,0,0,13 09/13/15,19,648,240.61,14962,0,0,0,13 09/13/15,20,629,238.669,15083.6,0,0,0,13 09/13/15,21,394,242.297,14857.8,0,0,0,13 09/13/15,22,493,295.181,12195.9,0,0,0,13 09/13/15,23,257,291.949,12886.7,0,0,0,13 </CODE></PRE> <P>Splunk, is forwarding both of the lines</P> <PRE><CODE>09/13/15,23,257,280.949,12813.7,0,0,0,13 09/13/15,23,257,291.949,12886.7,0,0,0,13 </CODE></PRE> <P>My timestamps key off the date and hour in the 1st and 2nd columns, and I only need the latest data for the timestamp, but I'm getting multiple events with the same timestamp due to the updating rows. Any suggestions? </P> Wed, 04 Nov 2015 15:17:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-only-see-the-latest-data-from-a-dynamically-changing/m-p/218738#M42989 ragedsparrow 2015-11-04T15:17:55Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-only-see-the-latest-data-from-a-dynamically-changing/m-p/218739#M42990 <P>You can use:</P> <PRE><CODE>... | sort - _indextime | dedup DATE HOUR WORKFILE_COUNT </CODE></PRE> Wed, 04 Nov 2015 15:29:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-only-see-the-latest-data-from-a-dynamically-changing/m-p/218739#M42990 woodcock 2015-11-04T15:29:40Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-only-see-the-latest-data-from-a-dynamically-changing/m-p/218740#M42991 <P>Ha! I should have known that. Thank you for your answer. It's perfect. I appreciate it.</P> Wed, 04 Nov 2015 15:31:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-only-see-the-latest-data-from-a-dynamically-changing/m-p/218740#M42991 ragedsparrow 2015-11-04T15:31:50Z