Getting Data In

Using only set of data with latest timestamp

michaelrosello
Path Finder

I have a data that comes from Splunk DB Connect in batch, this comes multiple times a day, But I only want to use latest batch.

This is what the data looks like. given this example the latest is the 10/04/18 10:19

Snapshot_date   timestamp   someotherfieldstocalculate
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19

I was able to get the result using eventstats comamnd below but by using that the search runs slower than without filtering. is there other way to filter this early or without using event stats that will improve the overall search time. my normal search takes 5secs but when I add the eventstats command and filtering it takes 15seconds.

| base search
| eventstats max(time_stamp) as latest_timestamp
| where time_stamp = latest_timestamp
0 Karma

HiroshiSatoh
Champion

It is easy if the time stamps are the same.

base search  [base search| head 1 | table timestamp]
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...