topic Re: Get the last Json Inserted document in Splunk Search

Get the last Json Inserted document

sibbsnb — Thu, 01 May 2014 16:43:52 GMT

I have an Index where i store huge Json documents. I want the last document inserted which contains the latest state. What is the most efficient command.

1) tail 1
2) latest
3) dedup

Re: Get the last Json Inserted document

richgalloway — Thu, 01 May 2014 17:14:06 GMT

Since Splunk searches backward in time, tail will give you the oldest entry rather than the latest. I prefer to use 'head 1' to find the most recent event.

Re: Get the last Json Inserted document

somesoni2 — Thu, 01 May 2014 17:24:03 GMT

If you just want one records which was inserted/indexed recently, head is the command you need. If you need last indexed records by a field (say host or user) then dedup or stats latest can be used.

Re: Get the last Json Inserted document

sibbsnb — Thu, 01 May 2014 18:25:10 GMT

Great, thanks a lot. That helps. So i don't even need to mention any time modifiers. Just do head 1 and i get the latest Json.