topic Re: Show last update from indexed csv file in Splunk Search

Show last update from indexed csv file

jugarugabi — Thu, 20 May 2021 08:30:49 GMT

Hi,

I have a csv file that is updated by a script once a minute.
The output is similar to:

time,queuename,vpn,last-message-id-spooled,max-message-size-exceeded,total-messages-spooled,num-messages-spooled,current-spool-usage-in-mb,bind-count,recordsinperiod,eol
2021-05-20_10-20,q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol
2021-05-20_10-20,q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol
2021-05-20_10-19,q.static.prp.solacequeue, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol
2021-05-20_10-19,q.static.prp.solacequeue-number2, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol

Now, I want to create a search query that will show only the last update in the csv file and show me the result like this:

q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol
q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol

Tried using the search below, but the output still shows everything that happened during the day, instead those only 2 lines.

index=* sourcetype=queues 
| stats latest(time) by time queuename last_message_id_spooled current_spool_usage_in_mb bind_count recordsinperiod

What am I missing?

Thanks,
Gabriel

Re: Show last update from indexed csv file

ITWhisperer — Thu, 20 May 2021 09:33:14 GMT

Will this work for you?

index=* sourcetype=queues | stats latest(*) as * by queuename

Re: Show last update from indexed csv file

jugarugabi — Thu, 20 May 2021 09:46:42 GMT

Thanks - that simple...

One more question: the line with the header is added as well to the results.
How can I remove that particular line and provide me only the information without the header that can be found in the csv file?

Re: Show last update from indexed csv file

ITWhisperer — Thu, 20 May 2021 09:55:37 GMT

if you are using inputlookup to read the csv file you can use the start=1 argument. If you already have ingested it into an index, you could use | where time!="time"

Re: Show last update from indexed csv file

jugarugabi — Thu, 20 May 2021 10:21:31 GMT

Yup, that did the trick.

Thanks mate!