topic Re: File Latest and Oldest in Splunk Search

File Latest and Oldest

akankshayadav — Sun, 23 May 2021 04:30:13 GMT

I have a file which I uploaded once (say 1 year ago), i uploaded it again (say 6 months ago) with some changes, and then I uploaded the same file again recently with some changes . But I want to display only the latest file and the latest-1 version of the file. i.e... if I upload a file for n- time, i only want to compare the nth and (n-1)th files, and grab the event(s) which if different in them. Can any one help?

Re: File Latest and Oldest

gcusello — Sun, 23 May 2021 05:46:39 GMT

Hi @akankshayadav ,

if each upload was done in the same day, you could run something like this:

In this way you'll have only events of the last two uploads.

Ciao.

Giuseppe

Re: File Latest and Oldest

akankshayadav — Sun, 23 May 2021 05:49:40 GMT

each upload was on different day, say for example.. 1st upload 2020, 2nd upload 1 month ago and 3rd today.Any help?

Re: File Latest and Oldest

gcusello — Mon, 24 May 2021 05:37:07 GMT

Hi @akankshayadav,

in this case, my solution should run, please try it.

Ciao.

Giuseppe