Getting Data In

How would I display the most recent indexed set of data via _time?

mcrawford44
Communicator

We have an index that uses imported data from a CSV. The data is imported daily. The '_time' field is populated by the system time of the import. This gives you the following;

_time1, name1, data1
_time2, name1, data2
_time3, name1, data3

_time1, name2, data1
_time2, name2, data2
_time3, name2, data3

Here we have two records with unique names that were indexed three times. If the record for name2 is deleted from a 4th import.. 1,2, and 3 will still show as they are in the index as historical data. How would I display only the latest 'snapshot or import' for this index?

In other words. Say I add more data on 6/12/2014. I want to dynamically display that latest set, while ignoring the past imports, so that deleted records do not show.

Example query being used. Simple I know.;

index=mdm_activesync | table _time, ID, Company, LinkedMasterAccount, DisplayName, Alias, ActiveSyncEnabled, LastSuccessSync, EmailAddress | sort 0 - LastSuccessSync
Tags (3)
0 Karma

somesoni2
Revered Legend

Try this

index=mdm_activesync | eventstats max(_time) as lastImport | where _time=lastImport| table _time, ID, Company, LinkedMasterAccount, DisplayName, Alias, ActiveSyncEnabled, LastSuccessSync, EmailAddress | sort 0 - LastSuccessSync

OR

index=mdm_activesync [index=mdm_activesync | stats max(_time) as _time | table _time ]| table _time, ID, Company, LinkedMasterAccount, DisplayName, Alias, ActiveSyncEnabled, LastSuccessSync, EmailAddress | sort 0 - LastSuccessSync
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...