Archive

Search latest indexed file for different sourcetype

Communicator

Hi,

I have 3 sources from which the files are loaded into Splunk, the time of arrival of files and frequency is different for all three.
source-1 -> every 5 minutes
source-2 -> every 1 hour
source-3 -> every 4 hours

Now, these files go into same folder based on version, which is a common field for all three, not the version. I want to search in the latest files (time based in their own family) of source-1, source-2 and source-3 irrespective of their comparative index time. I don't want to use transaction command.

Is it possible? If so, how?

Thanks,
Meenal

Tags (1)
0 Karma

Ultra Champion

If all your sources are on NTP or similar, so that you can trust the event timestamps, something like this perhaps?

(source=source_1 AND earliest=-5m) OR (source=source_2 AND earliest=-1h) OR (source=source_3 AND earliest=-4h) | the rest of your search

/Kristian

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!