File Latest and Oldest

[akankshayadav]

I have a file which I uploaded once (say 1 year ago), i uploaded it again (say 6 months ago) with some changes, and then I uploaded the same file again recently with some changes . But I want to display only the latest file and the latest-1 version of the file. i.e... if I upload a file for n- time, i only want to compare the nth and (n-1)th files, and grab the event(s) which if different in them. Can any one help? 

[gcusello]

Hi @akankshayadav ,

if each upload was done in the same day, you could run something like this:

index=your_index [ | metasearch 
     index=your_index earliest=0
     | bin span=1d _time
     | dedup _time
     | sort -_time
     | head 2
     | stats earliest(_time) AS earliest latest(_time) AS latest
     | eval latest=latest+86400
     | fields earliest latest
     ]
| ...

In this way you'll have only events of the last two uploads.

Ciao.

Giuseppe

[akankshayadav]

each upload was on different day, say for example.. 1st upload 2020, 2nd upload 1 month ago and 3rd today.Any help?

[gcusello]

Hi @akankshayadav,

in this case, my solution should run, please try it.

Ciao.

Giuseppe