https://community.splunk.com/t5/Getting-Data-In/How-do-you-pull-out-the-latest-entry-quot-only-quot-for-the-last/m-p/382328#M68924 <P>I have one file that is pulled in by a universal forwarder setup. </P> <P>This file is constantly changing on the system for which the file resides on, and the old data is never removed. I don't want the search to display historical data for each item as I only want Splunk to poll this data for the current date and have this data displayed. The file is a _json file with epoch time. Currently I have my SPL search and the following: </P> <PRE><CODE>earliest =-0d@d latest=now |dedup customer |eval trigger=strftime(last_number, "%T %F %Z") |table customer number trigger |rename trigger as Date_Time </CODE></PRE> <P>Would the above be accurate for me to attain only the results that I need? I only want to display the latest from this imported _json file for each customer based off the last_number field.</P> Tue, 29 Sep 2020 23:14:01 GMT bzsplunk54 2020-09-29T23:14:01Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-pull-out-the-latest-entry-quot-only-quot-for-the-last/m-p/382328#M68924 <P>I have one file that is pulled in by a universal forwarder setup. </P> <P>This file is constantly changing on the system for which the file resides on, and the old data is never removed. I don't want the search to display historical data for each item as I only want Splunk to poll this data for the current date and have this data displayed. The file is a _json file with epoch time. Currently I have my SPL search and the following: </P> <PRE><CODE>earliest =-0d@d latest=now |dedup customer |eval trigger=strftime(last_number, "%T %F %Z") |table customer number trigger |rename trigger as Date_Time </CODE></PRE> <P>Would the above be accurate for me to attain only the results that I need? I only want to display the latest from this imported _json file for each customer based off the last_number field.</P> Tue, 29 Sep 2020 23:14:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-pull-out-the-latest-entry-quot-only-quot-for-the-last/m-p/382328#M68924 bzsplunk54 2020-09-29T23:14:01Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-pull-out-the-latest-entry-quot-only-quot-for-the-last/m-p/382329#M68925 <P>The <CODE>stats latest(FIELD) as FIELD</CODE> command is going to be the best way to do this. </P> <P>Your current query may fail if you run it very early in the morning at as 12:05 am.</P> <P>Better to do something like <CODE>SEARCH | stats latest(last_numer) as last_number</CODE> or even SEARCH | stats latest(*) as *` This will return the most recent of all fields.</P> <P>Note that if you fields in the event change you might need some extra tricks that I can help you with.</P> <P>All the best</P> Wed, 13 Feb 2019 23:29:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-pull-out-the-latest-entry-quot-only-quot-for-the-last/m-p/382329#M68925 chrisyounger 2019-02-13T23:29:01Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-pull-out-the-latest-entry-quot-only-quot-for-the-last/m-p/382330#M68926 <P>That should be fine if <CODE>last_number</CODE> was used for <CODE>_time</CODE>. If not, you need this (and probably a wider/longer time span for <CODE>earliest</CODE><span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <PRE><CODE>earliest =-0d@d latest=now | sort 0 - last_number | dedup customer | eval Date_Time=strftime(last_number, "%T %F %Z") | table customer number Date_Time </CODE></PRE> Thu, 14 Feb 2019 00:46:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-pull-out-the-latest-entry-quot-only-quot-for-the-last/m-p/382330#M68926 woodcock 2019-02-14T00:46:58Z