Getting Data In

Using only set of data with latest timestamp

michaelrosello
Path Finder

I have a data that comes from Splunk DB Connect in batch, this comes multiple times a day, But I only want to use latest batch.

This is what the data looks like. given this example the latest is the 10/04/18 10:19

Snapshot_date   timestamp   someotherfieldstocalculate
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19

I was able to get the result using eventstats comamnd below but by using that the search runs slower than without filtering. is there other way to filter this early or without using event stats that will improve the overall search time. my normal search takes 5secs but when I add the eventstats command and filtering it takes 15seconds.

| base search
| eventstats max(time_stamp) as latest_timestamp
| where time_stamp = latest_timestamp
0 Karma

HiroshiSatoh
Champion

It is easy if the time stamps are the same.

base search  [base search| head 1 | table timestamp]
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...