topic Re: how to only check events from the latest source file in Splunk Search

how to only check events from the latest source file

gent79 — Tue, 29 Sep 2020 11:28:16 GMT

I have a boat load of log files, whose name contains the timestamp, like this :
/DATA/show_cpu.2016101908.gz
/DATA/show_cpu.2016102108.gz

I only want to check the event in the latest file, so I tried following command:
index="-cli" source="show_cpu" | stats latest(source) by deviceId,fiveMinutes,timeStamp*

Unfortunately, the search results contains the events from other source file.

Please help out.

Re: how to only check events from the latest source file

inventsekar — Thu, 20 Oct 2016 12:00:36 GMT

check this one -

index="-cli" | stats latest(source) by host,deviceId,fiveMinutes,timeStamp*

if above wont work, then check these two-

    <pre>index="-cli" | stats latest(source) by host</pre>

and

index="-cli" [search index="-cli" | stats latest(source) by host| table source] | table deviceId,fiveMinutes,timeStamp*

Re: how to only check events from the latest source file

sundareshr — Thu, 20 Oct 2016 13:26:28 GMT

Try this, assuming the all events from the source have the same

base search | eventstats max(_indextime) as it | where it=_time

Re: how to only check events from the latest source file

priyaramki16 — Mon, 06 Jul 2020 10:06:04 GMT

Hi...I tried the answer which you provided...It didn't work..is there any other way...

Re: how to only check events from the latest source file

priyaramki16 — Mon, 06 Jul 2020 10:07:20 GMT

Hi @inventsekar ..I tried the solution which u provided...It didnot work is there any other solution