Getting Data In

Using only set of data with latest timestamp

michaelrosello
Path Finder

I have a data that comes from Splunk DB Connect in batch, this comes multiple times a day, But I only want to use latest batch.

This is what the data looks like. given this example the latest is the 10/04/18 10:19

Snapshot_date   timestamp   someotherfieldstocalculate
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19

I was able to get the result using eventstats comamnd below but by using that the search runs slower than without filtering. is there other way to filter this early or without using event stats that will improve the overall search time. my normal search takes 5secs but when I add the eventstats command and filtering it takes 15seconds.

| base search
| eventstats max(time_stamp) as latest_timestamp
| where time_stamp = latest_timestamp
0 Karma

HiroshiSatoh
Champion

It is easy if the time stamps are the same.

base search  [base search| head 1 | table timestamp]
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...