Splunk Search

Is it possible to search the modified date/time of a file?

rmsagar
Engager

Is it possible to get the modified date/time of a file in search? The search below shows the time based on events and because of that, I have multiple entries of the same file. Will it be possible to generate a unique list?

host="*" source="/log/*" | table by source, _time

Thanks!

Tags (3)
0 Karma
1 Solution

rmsagar
Engager

Thanks a ton for your time and help. Found out the transaction seem to suit the requirement. Thanks Again. ciao

View solution in original post

0 Karma

rmsagar
Engager

Thanks a ton for your time and help. Found out the transaction seem to suit the requirement. Thanks Again. ciao

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

OR even better/faster:

| tstats latest(_time) as _time where index=* by source

Also includes that unique last-modified timestamp per source @rmsagar asked for 🙂

somesoni2
Revered Legend

Splunk doesn't store the file properties like Last Modified date in Splunk when monitoring the file. If you just want the unique list of sources from all hosts, try something like this

host="*" source="/log/* | stats count by source | table source

OR bette/faster

| metadata type=sources index=* OR index=_* | search source="/log/*" | table source
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...