If you are speaking about a scheduled search, than the answer is definitely yes: you do that by playing with the frequency of execution and earliest/latest times. E.g. If you automatically run the query every 30 minutes, you might want to have:
... earliest=-31m@m latest=-1m@m
To pick 30 mnutes worth of data, but allowing splunk a 1 minute delay to index data which has just arrived.
If instead you are speaking about manual execution I don't think that is easily feasible.
If you are speaking about a scheduled search, than the answer is definitely yes: you do that by playing with the frequency of execution and earliest/latest times. E.g. If you automatically run the query every 30 minutes, you might want to have:
... earliest=-31m@m latest=-1m@m
To pick 30 mnutes worth of data, but allowing splunk a 1 minute delay to index data which has just arrived.
If instead you are speaking about manual execution I don't think that is easily feasible.
I see...then why not use a saved and scheduled search, which fires your python script when it finds new events? The script would receive a csv of the new results and save you a headache 😉
I have a python script that I want to run when certain event occurs and I want to get data that changed since last time I ran the query.
Right now I am saving the timestamp to the file and use it next time I run the query.