https://community.splunk.com/t5/Getting-Data-In/how-to-pick-values-by-latest-source/m-p/383623#M69070 <P>Hi,</P> <P>My source file gets updated every 5 minutute . How to chart values of a field by the latest source file?</P> Thu, 14 Jun 2018 08:30:05 GMT Mohsin123 2018-06-14T08:30:05Z https://community.splunk.com/t5/Getting-Data-In/how-to-pick-values-by-latest-source/m-p/383623#M69070 <P>Hi,</P> <P>My source file gets updated every 5 minutute . How to chart values of a field by the latest source file?</P> Thu, 14 Jun 2018 08:30:05 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-pick-values-by-latest-source/m-p/383623#M69070 Mohsin123 2018-06-14T08:30:05Z https://community.splunk.com/t5/Getting-Data-In/how-to-pick-values-by-latest-source/m-p/383624#M69071 <P>Assuming your updated source file gets indexed every 5 minutes- meaning you will have new events indexed every 5 minutes, what you can try out is - <CODE>&lt;your search&gt; |eventstats max(_time) as time | where _time=time| &lt;rest of your query&gt;</CODE><BR /> This ensures that ONLY the latest time events are being picked up for further processing after the where condition</P> Fri, 15 Jun 2018 11:35:06 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-pick-values-by-latest-source/m-p/383624#M69071 Sukisen1981 2018-06-15T11:35:06Z