I have 3 sources from which the files are loaded into Splunk, the time of arrival of files and frequency is different for all three.
source-1 -> every 5 minutes
source-2 -> every 1 hour
source-3 -> every 4 hours
Now, these files go into same folder based on version, which is a common field for all three, not the version. I want to search in the latest files (time based in their own family) of source-1, source-2 and source-3 irrespective of their comparative index time. I don't want to use transaction command.