Hi,
I want to import a growing .csv every week, so there will be duplicate events. In the report I only want to analyse the latest version of the csv/the latest dataset.
My first thought is to filter the latest indextime
my base search
| eventstats max(_indextime) AS max_indextime
| where _indextime=max_indextime
But I'm not sure whether the imported events will always have the same indextime per import. Or can the indextime vary for large csv files?
Thanks in advance
Hi HeinzWaescher,
let me better understand:
you import events from a csv every period (e.g. one day) in an index and then you need to use the latest imported version, is this correct'?
You could:
In this way you have only the latest information you need.
Bye.
Giuseppe
Can you share header and event for your CSV file? Also when the CSV file grows over time, does the filename(source) change?
Hi HeinzWaescher,
let me better understand:
you import events from a csv every period (e.g. one day) in an index and then you need to use the latest imported version, is this correct'?
You could:
In this way you have only the latest information you need.
Bye.
Giuseppe