Hi,
I have 3 sources from which the files are loaded into Splunk, the time of arrival of files and frequency is different for all three.
source-1 -> every 5 minutes
source-2 -> every 1 hour
source-3 -> every 4 hours
Now, these files go into same folder based on version, which is a common field for all three, not the version. I want to search in the latest files (time based in their own family) of source-1, source-2 and source-3 irrespective of their comparative index time. I don't want to use transaction command.
Is it possible? If so, how?
Thanks,
Meenal
If all your sources are on NTP or similar, so that you can trust the event timestamps, something like this perhaps?
(source=source_1 AND earliest=-5m) OR (source=source_2 AND earliest=-1h) OR (source=source_3 AND earliest=-4h) | the rest of your search
/Kristian