How to get distinct count of a field only for the latest events?

[tmayllart]

I'm constantly feeding my splunk with a .csv source, all of them with a pattern ïn their name: "Data1.csv", "Data2.csv", "Data3.csv", etc...
These csv's have a table like:

_time | Extracted_Host | Info1 | Info2 | Info3

How could I search only for the distinct count of Extracted_host, but only counting based on the latest submitted events? For example: if the latest csv is called Data5.csv, I want my search to get the distinct count of extracted_Host in the Data5.csv, if is Data6.csv, I want my search to get the distinct count of extracted_Host in Data6.csv

[KailA]

Hi,

This is how I would do it:

index=yourindex [search index=yourindex | head 1 | fields source ]
| you  distinct count search here

If your data are order that should work
Let me know 🙂

Kail