Finding the latest source file per day

[Nadhiyaa]

My script runs every 2 hrs per day .But i need the latest file per day for a timerange to do some calculation.

[FrankVl]

Are you looking for the event(s) related to that latest file, or for the file(name) itself? It would help if you could elaborate a bit on what your data looks like, what the output is that you're after (and perhaps what you have tried so far).

In general, to get the latest something per day, you could do something along the lines of:

index=foo
| eval day = _time
| bin day span=1d 
| stats latest(source) by day
| convert ctime(day)

Which gets you the latest value of the source field per day, for the given index.

[Nadhiyaa]

it works !! Thanks

[FrankVl]

Cool 🙂

I've changed my comment to an answer, so you can mark it as accepted.