https://community.splunk.com/t5/Splunk-Search/How-to-get-results-only-from-latest-source-file-of-particular/m-p/461237#M191373 <P>I think </P> <PRE><CODE>index="index_sdx2" sourcetype=splunk_data [search index="index_sdx2" sourcetype=splunk_data | head 1 | fields source] </CODE></PRE> <P>should work.</P> Wed, 16 Oct 2019 09:21:57 GMT knielsen 2019-10-16T09:21:57Z https://community.splunk.com/t5/Splunk-Search/How-to-get-results-only-from-latest-source-file-of-particular/m-p/461236#M191372 <P>HI,<BR /> I got an index which send data to sourcetype with new source file every week.<BR /> what I want is to my dashboard search query only return events from the latest source file. <BR /> For example , my index is - index_sdx2 sourctype is -- splunk_data and there are multiple sources inside this sourcetype like data1.csv data1_10082019.csv data1_11102019.csv <BR /> And I want to take only data from latest source , that is all events from source= data1_11102019.csv<BR /> I tried like below<BR /> index="index_sdx2" sourcetype=splunk_data |eventstats first(_time) as time | where _time==time <BR /> But its not giving all data from source data1_11102019.csv<BR /> please suggest. </P> Wed, 30 Sep 2020 02:38:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-results-only-from-latest-source-file-of-particular/m-p/461236#M191372 avni26 2020-09-30T02:38:06Z https://community.splunk.com/t5/Splunk-Search/How-to-get-results-only-from-latest-source-file-of-particular/m-p/461237#M191373 <P>I think </P> <PRE><CODE>index="index_sdx2" sourcetype=splunk_data [search index="index_sdx2" sourcetype=splunk_data | head 1 | fields source] </CODE></PRE> <P>should work.</P> Wed, 16 Oct 2019 09:21:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-results-only-from-latest-source-file-of-particular/m-p/461237#M191373 knielsen 2019-10-16T09:21:57Z https://community.splunk.com/t5/Splunk-Search/How-to-get-results-only-from-latest-source-file-of-particular/m-p/461238#M191374 <P>@knielsen, yes its working.Thank you. But performance is slow. Its taking too much time load in dashboard.</P> Wed, 16 Oct 2019 09:36:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-results-only-from-latest-source-file-of-particular/m-p/461238#M191374 avni26 2019-10-16T09:36:28Z