How to retrieve data from the latest file that splunk indexes?

[smruti13]

I have 2 indexes( a summary index and a normal index).
I want to search the summary index for all time but want to get only the latest file from the other index i.e time range should be last 30 days, in the same query.
something like this -
(index=dummy_index_summary report_name=dummy_report) OR (index="dummy_index" (sourcetype="abc" host="auirvcbpw001" source="abc" ))

first query should execute for all time whereas second one should excecute for the last 30 days(somehow should return only the latest file) , in the same query.

Can someone please help me ? Thanks in advance!

[Sukisen1981 · Accepted solution]

try this

(index=dummy_index_summary report_name=dummy_report) OR (index="dummy_index" earliest=-30d (sourcetype="abc" host="auirvcbpw001" source="abc" ))

[smruti13]

Thanks @Sukisen1981 works like a charm 🙂

[vikash_periwal]

HI to this i have one query, for 2nd index i want to select the latest source file , how can we achieve that..
i used |stats latest(source) as source but getting error while running the script

[KARANMALHOTRA]

Have you tried creating two separate searches and appending their results together. It may be able to do the job you want.

[smruti13]

cant use join or append as it makes the query heavy which in turn affects performance. So have to look for a way other than append or join.