Getting Data In

Using only set of data with latest timestamp

michaelrosello
Path Finder

I have a data that comes from Splunk DB Connect in batch, this comes multiple times a day, But I only want to use latest batch.

This is what the data looks like. given this example the latest is the 10/04/18 10:19

Snapshot_date   timestamp   someotherfieldstocalculate
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 1:30   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 5:49   
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19  
10/04/18    10/04/18 10:19

I was able to get the result using eventstats comamnd below but by using that the search runs slower than without filtering. is there other way to filter this early or without using event stats that will improve the overall search time. my normal search takes 5secs but when I add the eventstats command and filtering it takes 15seconds.

| base search
| eventstats max(time_stamp) as latest_timestamp
| where time_stamp = latest_timestamp
0 Karma

HiroshiSatoh
Champion

It is easy if the time stamps are the same.

base search  [base search| head 1 | table timestamp]
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...