Get the last Json Inserted document

[sibbsnb]

I have an Index where i store huge Json documents. I want the last document inserted which contains the latest state. What is the most efficient command.

1) tail 1
2) latest
3) dedup

[richgalloway · Accepted solution]

Since Splunk searches backward in time, tail will give you the oldest entry rather than the latest. I prefer to use 'head 1' to find the most recent event.

[sibbsnb]

Great, thanks a lot. That helps. So i don't even need to mention any time modifiers. Just do head 1 and i get the latest Json.

[somesoni2]

If you just want one records which was inserted/indexed recently, head is the command you need. If you need last indexed records by a field (say host or user) then dedup or stats latest can be used.