https://community.splunk.com/t5/Splunk-Search/Finding-the-latest-source-file-per-day/m-p/377585#M172129 <P>My script runs every 2 hrs per day .But i need the latest file per day for a timerange to do some calculation. </P> Mon, 01 Apr 2019 07:48:19 GMT Nadhiyaa 2019-04-01T07:48:19Z https://community.splunk.com/t5/Splunk-Search/Finding-the-latest-source-file-per-day/m-p/377585#M172129 <P>My script runs every 2 hrs per day .But i need the latest file per day for a timerange to do some calculation. </P> Mon, 01 Apr 2019 07:48:19 GMT https://community.splunk.com/t5/Splunk-Search/Finding-the-latest-source-file-per-day/m-p/377585#M172129 Nadhiyaa 2019-04-01T07:48:19Z https://community.splunk.com/t5/Splunk-Search/Finding-the-latest-source-file-per-day/m-p/377586#M172130 <P>Are you looking for the event(s) related to that latest file, or for the file(name) itself? It would help if you could elaborate a bit on what your data looks like, what the output is that you're after (and perhaps what you have tried so far).</P> <P>In general, to get the latest something per day, you could do something along the lines of:</P> <PRE><CODE>index=foo | eval day = _time | bin day span=1d | stats latest(source) by day | convert ctime(day) </CODE></PRE> <P>Which gets you the latest value of the source field per day, for the given index.</P> Mon, 01 Apr 2019 08:21:52 GMT https://community.splunk.com/t5/Splunk-Search/Finding-the-latest-source-file-per-day/m-p/377586#M172130 FrankVl 2019-04-01T08:21:52Z https://community.splunk.com/t5/Splunk-Search/Finding-the-latest-source-file-per-day/m-p/377587#M172131 <P>it works !! Thanks</P> Wed, 19 Jun 2019 05:40:14 GMT https://community.splunk.com/t5/Splunk-Search/Finding-the-latest-source-file-per-day/m-p/377587#M172131 Nadhiyaa 2019-06-19T05:40:14Z https://community.splunk.com/t5/Splunk-Search/Finding-the-latest-source-file-per-day/m-p/377588#M172132 <P>Cool <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>I've changed my comment to an answer, so you can mark it as accepted.</P> Wed, 19 Jun 2019 06:39:05 GMT https://community.splunk.com/t5/Splunk-Search/Finding-the-latest-source-file-per-day/m-p/377588#M172132 FrankVl 2019-06-19T06:39:05Z