Getting Data In

Can we fetch the last available data in an index , which is not ingested in the last 24hrs?

shahid285
Path Finder

I have an requirement to show the data for last 24hrs. If the data is not available for the last 24hrs, i need to show the 24hrs data which was ingested very lastly.
Example :
If i had ingested data on 28-May-2019:00:00:00
and querying that data on 29-May-2019:03:34:00(consider it to be latest=now), i would be seeing the data.

if now is 30-May-2019:02:34:59. And if i run the query with earliest=-24hrs , i would not get any data.

But i need the 24hrs data here, which was lastly ingested. That would on 28-May-2019:00:00:00.

A sample query would be helpful here.

Thanks
Shahid

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Would something like the following work for you?

[YOUR BASE SEARCH] 
| eventstats max(_time) as mylatest 
| where _time > mylatest-86400

The eventstats is calculating the latest time for the base search, which would be available in each event. You then filter where the _time of each event is within 24 hours of the last event you received.

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

Would something like the following work for you?

[YOUR BASE SEARCH] 
| eventstats max(_time) as mylatest 
| where _time > mylatest-86400

The eventstats is calculating the latest time for the base search, which would be available in each event. You then filter where the _time of each event is within 24 hours of the last event you received.

View solution in original post

shahid285
Path Finder

@kmorris_splunk : Thanks a lot, your solution worked as expected

Thanks again!

Shahid

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!