Splunk Search

How to get results only from latest source file of particular sourcetype

avni26
Explorer

HI,
I got an index which send data to sourcetype with new source file every week.
what I want is to my dashboard search query only return events from the latest source file.
For example , my index is - index_sdx2 sourctype is -- splunk_data and there are multiple sources inside this sourcetype like data1.csv data1_10082019.csv data1_11102019.csv
And I want to take only data from latest source , that is all events from source= data1_11102019.csv
I tried like below
index="index_sdx2" sourcetype=splunk_data |eventstats first(_time) as time | where _time==time
But its not giving all data from source data1_11102019.csv
please suggest.

Tags (1)
0 Karma
1 Solution

knielsen
Contributor

I think

index="index_sdx2" sourcetype=splunk_data [search index="index_sdx2" sourcetype=splunk_data | head 1 | fields source]

should work.

View solution in original post

0 Karma

knielsen
Contributor

I think

index="index_sdx2" sourcetype=splunk_data [search index="index_sdx2" sourcetype=splunk_data | head 1 | fields source]

should work.

0 Karma

avni26
Explorer

@knielsen, yes its working.Thank you. But performance is slow. Its taking too much time load in dashboard.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...