How to get the latest events

[manjuase]

Hi

I have two csv which got indexed

csv 1:

Step No,Release Name,Execution Time,Status
1,TA,02-16-2018 at 10:32:32 UTC,Pass
2.TA,02-16-2018 at 10:32:33 UTC,Fail

csv 2:
Step No,Release Name,Execution Time,Status
1,TA,02-16-2018 at 12:40:42 UTC,Pass
2.TA,02-16-2018 at 10:41:43 UTC,Pass

only Execution Time and Status will differ in both the file. indexing time(_time) will be "Execution Time"

my question is i want to get the data from csv2 only as it is only having latest timestamp using pivot .. i don't want to show the data from csv1 as it is having earliest timestamp .

Can somebody help me on this ?

Thanks in advance

[FrankVl]

Assuming the filename of the csv file is in the source field and the two csv files actually have unique names, you should be able to filter by the source field.

If there is no field that explicitely states which entry came from which csv file, then I guess the best you can do is deduplicate based on Step No and Release Name (assuming those two together uniquely identify a record), while sorting for _time...