https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253641#M75927 <P>Hi there,</P> <P>My external program is retrieving the data and creating lookup table every night. The files are stored like below.<BR /> <CODE>$SPLUNK_HOME/etc/apps/MyApp/lookups/FILE_YYYYmmdd</CODE>.</P> <P>The thing is I have to check the lookup table manually and give the list to my colleague every time since they don't know SPL at all.<BR /> Is there any good SPL to display only the latest contents of lookup flle on dashboard?</P> <P>Thanks in advance.</P> Tue, 01 Dec 2015 07:07:04 GMT kuga_mbsd 2015-12-01T07:07:04Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253641#M75927 <P>Hi there,</P> <P>My external program is retrieving the data and creating lookup table every night. The files are stored like below.<BR /> <CODE>$SPLUNK_HOME/etc/apps/MyApp/lookups/FILE_YYYYmmdd</CODE>.</P> <P>The thing is I have to check the lookup table manually and give the list to my colleague every time since they don't know SPL at all.<BR /> Is there any good SPL to display only the latest contents of lookup flle on dashboard?</P> <P>Thanks in advance.</P> Tue, 01 Dec 2015 07:07:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253641#M75927 kuga_mbsd 2015-12-01T07:07:04Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253642#M75928 <P>Have you considered rotating the "old" lookup files instead? By this you wouldn't have to check a new lookup file every day.</P> <OL> <LI>Copy lookup.csv file to lookup_current_date.csv</LI> <LI>Overwrite lookup.csv</LI> </OL> <P>You don't have to change anything in the SPL or in your dahsboards this way.</P> Tue, 29 Sep 2020 08:01:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253642#M75928 DMohn 2020-09-29T08:01:15Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253643#M75929 <P>Thank you very much for your reply, DMohn.</P> <P>I think your idea sounds good, however, I'm afraid that it doesnt work for my case because I need to keep the date of file creation at the file name for the records.</P> <P>Please advise.</P> Tue, 01 Dec 2015 09:07:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253643#M75929 kuga_mbsd 2015-12-01T09:07:58Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253644#M75930 <P>Is the file name "for the records" needed within the lookup as well?</P> <P>Otherwise you could go for creating two files with your external data source: the lookup.csv which will be used by Splunk dashboard, and a FILE_YYYYmmdd, as you do currently. Furthermore, you could use a small script, which lists the contents of your lookup directory, splunk the results, and display the latest file name on your dashboard for reference.</P> Tue, 01 Dec 2015 10:51:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253644#M75930 DMohn 2015-12-01T10:51:10Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253645#M75931 <P>well... yes, I was thinking exact your suggestions, to create two files or make script.<BR /> I was wondering if I could make it by SPL, but it seems undoable...</P> <P>Anyway, thanks a lot, DMohn!</P> Wed, 02 Dec 2015 00:30:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253645#M75931 kuga_mbsd 2015-12-02T00:30:45Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253646#M75932 <P>SPL can do it easy. </P> <P>2 ways. You can either have it copy the data OR have the macro fill in the name based on an eval.</P> <OL> <LI>You will have both the old with old filename and also a newer one that can always be accessed with the same name/definition.</LI> </OL> <P>Just do an</P> <PRE><CODE>inputlookup `latest_lookup_file` | outputlookup latestlookup </CODE></PRE> <P>"latest_lookup_file" is macro that will figure out the file format that you specified automatically.<BR /> latestlookup should be a definition pointing to another csv file that users will always access.</P> <P>ie. macros.conf</P> <PRE><CODE>[latest_lookup_file] definition = lower(strftime(relative_time(time(), "@d"), "FILE_%Y%m%d.csv")) iseval = 1 </CODE></PRE> <P>Now schedule that inputlookup line as a savedsearch that is run some time after the your file is scheduled to be uploaded.</P> <P>or 2. Use the macro from above and just call it directly.</P> <PRE><CODE>inputlookup `latest_lookup_file` </CODE></PRE> <P>That will automatically find the latest file. There won't be a copy but all your old ones will be there. The downside to this is that if your script doesn't run anything that uses this macro will fail the next day. Method 1 is safest.</P> <P>Enjoy!</P> Tue, 29 Sep 2020 08:03:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253646#M75932 Lucas_K 2020-09-29T08:03:32Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253647#M75933 <P>Thank you for your comment, Lucas.</P> <P>Seems like it is doable with using macros.conf!<BR /> I've never configured this file but worth to try.</P> <P>Thanks a bunch!!</P> Wed, 02 Dec 2015 04:00:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253647#M75933 kuga_mbsd 2015-12-02T04:00:51Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253648#M75934 <P>That's really clever! I love that you're using strftime to generate the filename <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sun, 10 Apr 2016 22:26:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-only-show-the-latest-contents-of-a/m-p/253648#M75934 joxley 2016-04-10T22:26:19Z