topic Re: How to get results only from the last source file? in Getting Data In

How to get results only from the last source file?

bruno_eduardo — Fri, 20 Nov 2015 15:12:37 GMT

Hi,

I got an index which continuously receive new source file automatically, what I want is to my search to only return events from the last source file. Should be something simple but I did not figure it out, maybe with the |head command.

Re: How to get results only from the last source file?

woodcock — Fri, 20 Nov 2015 15:37:16 GMT

Like this (replace ... with the exact same base search; yes, twice):

... [ ... | stats latest(source) AS source ]

Re: How to get results only from the last source file?

bruno_eduardo — Fri, 20 Nov 2015 15:44:00 GMT

Thanks!!!!

Re: How to get results only from the last source file?

bruno_eduardo — Fri, 20 Nov 2015 15:56:28 GMT

What about the Before Last?

Re: How to get results only from the last source file?

woodcock — Fri, 20 Nov 2015 16:07:41 GMT

Like this:

... NOT [ ... | stats latest(source) AS source ]

Re: How to get results only from the last source file?

bruno_eduardo — Fri, 20 Nov 2015 16:34:40 GMT

But I mean before last source file only

Re: How to get results only from the last source file?

woodcock — Fri, 20 Nov 2015 16:52:23 GMT

Did you try it? That's what it does.

Re: How to get results only from the last source file?

bruno_eduardo — Fri, 20 Nov 2015 17:30:32 GMT

Yes I tried, I have 20 source files for this index and when I do this I got 19, every each of them except the last one. What I need is only the 19th one. I already got the 20th with your answer, just need the before last.

Re: How to get results only from the last source file?

woodcock — Sat, 21 Nov 2015 02:02:31 GMT

Like this:

... [ ... | dedup source | reverse | list(source) AS source| eval source=mvindex(source,1) ]

You can then adjust the 1 to whichever one you would like.

Re: How to get results only from the last source file?

bruno_eduardo — Mon, 23 Nov 2015 14:48:05 GMT

That is really great but don't solve the problem, This search would only help if I had a fixed number of source files, the problems is: The index continuously receive new source file automatically, so I would need to change the search every time.

Re: How to get results only from the last source file?

bruno_eduardo — Mon, 23 Nov 2015 14:57:45 GMT

Sorry it worked, without the |reverse, look:

index="myindex" [search index="myindex" | dedup source |stats list(source) AS source| eval source=mvindex(source,2) ]

this bring myu before last source file events.

Thanks

Re: How to get results only from the last source file?

jul1an — Tue, 14 Nov 2017 12:33:55 GMT

Yes!! In my case I have solved with head comand:

index=index1 source="file.csv" Status="Active" [search index=index1 source="file.csv" | dedup _time | head 1 | return _time] |...