Getting Data In
Highlighted

How to get distinct count of a field only for the latest events?

New Member

I'm constantly feeding my splunk with a .csv source, all of them with a pattern ïn their name: "Data1.csv", "Data2.csv", "Data3.csv", etc...
These csv's have a table like:

time | ExtractedHost | Info1 | Info2 | Info3

How could I search only for the distinct count of Extractedhost, but only counting based on the latest submitted events? For example: if the latest csv is called Data5.csv, I want my search to get the distinct count of extractedHost in the Data5.csv, if is Data6.csv, I want my search to get the distinct count of extracted_Host in Data6.csv

0 Karma
Highlighted

Re: How to get distinct count of a field only for the latest events?

Contributor

Hi,

This is how I would do it:

index=yourindex [search index=yourindex | head 1 | fields source ]
| you  distinct count search here

If your data are order that should work
Let me know 🙂

Kail

0 Karma