Splunk Search

How to get the latest events



I have two csv which got indexed

csv 1:

Step No,Release Name,Execution Time,Status
1,TA,02-16-2018 at 10:32:32 UTC,Pass
2.TA,02-16-2018 at 10:32:33 UTC,Fail

csv 2:
Step No,Release Name,Execution Time,Status
1,TA,02-16-2018 at 12:40:42 UTC,Pass
2.TA,02-16-2018 at 10:41:43 UTC,Pass

only Execution Time and Status will differ in both the file. indexing time(_time) will be "Execution Time"

my question is i want to get the data from csv2 only as it is only having latest timestamp using pivot .. i don't want to show the data from csv1 as it is having earliest timestamp .

Can somebody help me on this ?

Thanks in advance

Tags (1)
0 Karma

Ultra Champion

Assuming the filename of the csv file is in the source field and the two csv files actually have unique names, you should be able to filter by the source field.

If there is no field that explicitely states which entry came from which csv file, then I guess the best you can do is deduplicate based on Step No and Release Name (assuming those two together uniquely identify a record), while sorting for _time...

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...