Getting Data In

Using only set of data with latest timestamp

michaelrosello
Path Finder

I have a data that comes from Splunk DB Connect in batch, this comes multiple times a day, But I only want to use latest batch.

This is what the data looks like. given this example the latest is the 10/04/18 10:19

Snapshot_date   timestamp   someotherfieldstocalculate
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19

I was able to get the result using eventstats comamnd below but by using that the search runs slower than without filtering. is there other way to filter this early or without using event stats that will improve the overall search time. my normal search takes 5secs but when I add the eventstats command and filtering it takes 15seconds.

| base search
| eventstats max(time_stamp) as latest_timestamp
| where time_stamp = latest_timestamp
0 Karma

HiroshiSatoh
Champion

It is easy if the time stamps are the same.

base search  [base search| head 1 | table timestamp]
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...