How can I grab the latest source from a csv file, ranging from the earliest to anything within 5 minutes of that time?

[chadman]

I have splunk import a csv file every time it's changed. Splunk imports each line of the csv file as an event. I have tried to do a search by the latest time and that works, but sometimes it takes couple seconds for splunk to import the file and it will have multiple time stamps across all the events for that one import. Any way to grab the latest source from the earliest to anything with 5 min of that time?

[somesoni2]

Try like this

index=foo sourcetype=bar source=*yourfile.csv  [| tstats max(_time) as latest WHERE index=foo sourcetype=bar source=*yourfile.csv |eval latest=latest+1 |  eval earliest=relative_time(lateset,"-5m") | table earliest latest ]