Is it possible to get the modified date/time of a file in search? The search below shows the time based on events and because of that, I have multiple entries of the same file. Will it be possible to generate a unique list?
host="*" source="/log/*" | table by source, _time
Thanks!
Thanks a ton for your time and help. Found out the transaction seem to suit the requirement. Thanks Again. ciao
Thanks a ton for your time and help. Found out the transaction seem to suit the requirement. Thanks Again. ciao
OR even better/faster:
| tstats latest(_time) as _time where index=* by source
Also includes that unique last-modified timestamp per source @rmsagar asked for 🙂
Splunk doesn't store the file properties like Last Modified date in Splunk when monitoring the file. If you just want the unique list of sources from all hosts, try something like this
host="*" source="/log/* | stats count by source | table source
OR bette/faster
| metadata type=sources index=* OR index=_* | search source="/log/*" | table source