Splunk Search

Is it possible to search the modified date/time of a file?

rmsagar
Engager

Is it possible to get the modified date/time of a file in search? The search below shows the time based on events and because of that, I have multiple entries of the same file. Will it be possible to generate a unique list?

host="*" source="/log/*" | table by source, _time

Thanks!

Tags (3)
0 Karma
1 Solution

rmsagar
Engager

Thanks a ton for your time and help. Found out the transaction seem to suit the requirement. Thanks Again. ciao

View solution in original post

0 Karma

rmsagar
Engager

Thanks a ton for your time and help. Found out the transaction seem to suit the requirement. Thanks Again. ciao

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

OR even better/faster:

| tstats latest(_time) as _time where index=* by source

Also includes that unique last-modified timestamp per source @rmsagar asked for 🙂

somesoni2
SplunkTrust
SplunkTrust

Splunk doesn't store the file properties like Last Modified date in Splunk when monitoring the file. If you just want the unique list of sources from all hosts, try something like this

host="*" source="/log/* | stats count by source | table source

OR bette/faster

| metadata type=sources index=* OR index=_* | search source="/log/*" | table source
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...