I have a data that comes from Splunk DB Connect in batch, this comes multiple times a day, But I only want to use latest batch.
This is what the data looks like. given this example the latest is the 10/04/18 10:19
Snapshot_date timestamp someotherfieldstocalculate
10/04/18 10/04/18 1:30
10/04/18 10/04/18 1:30
10/04/18 10/04/18 1:30
10/04/18 10/04/18 5:49
10/04/18 10/04/18 5:49
10/04/18 10/04/18 5:49
10/04/18 10/04/18 10:19
10/04/18 10/04/18 10:19
10/04/18 10/04/18 10:19
I was able to get the result using eventstats comamnd below but by using that the search runs slower than without filtering. is there other way to filter this early or without using event stats that will improve the overall search time. my normal search takes 5secs but when I add the eventstats command and filtering it takes 15seconds.
| base search
| eventstats max(time_stamp) as latest_timestamp
| where time_stamp = latest_timestamp
