Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Extract Data which ever is newly added or upda...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Team,
Am facing one issue, my requriement is to continously monitor the file and want to pick only the latest records which are newly added and should ignore older events, i just want to take only latest events which option should i enable to satisfy my requirement.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no option to take only the latest events. However, there are many ways to do it, depending on your specific needs.
For example, if you want to see only the latest event for each ip address, use the dedup command:
yoursearchhere | dedup src_ip
This example assumes that the ip address is in a field called src_ip.
If your definition of "the latest events" means "all events in the last minute", then you can use Custom Time in the time selection drop down to set that for your search. Or you could use a realtime search if you need to see the events continuously updated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no option to take only the latest events. However, there are many ways to do it, depending on your specific needs.
For example, if you want to see only the latest event for each ip address, use the dedup command:
yoursearchhere | dedup src_ip
This example assumes that the ip address is in a field called src_ip.
If your definition of "the latest events" means "all events in the last minute", then you can use Custom Time in the time selection drop down to set that for your search. Or you could use a realtime search if you need to see the events continuously updated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Um, surely you just search for earliest=-5h@h ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi lguinn,
Yours answer looks good but my scenario is monitor for every 5 hours, in first hour i have fetched 4000 events and analyzed the data, at the second 5th hour i got 5000 events. Now i had to only analyze the latest 5000 events not total 9000 events.. plz help me
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
