Is it possible to search the modified date/time of a file?

[rmsagar]

Is it possible to get the modified date/time of a file in search? The search below shows the time based on events and because of that, I have multiple entries of the same file. Will it be possible to generate a unique list?

host="*" source="/log/*" | table by source, _time

Thanks!

[rmsagar · Accepted solution]

Thanks a ton for your time and help. Found out the transaction seem to suit the requirement. Thanks Again. ciao

[martin_mueller]

OR even better/faster:

| tstats latest(_time) as _time where index=* by source

Also includes that unique last-modified timestamp per source @rmsagar asked for 🙂

[somesoni2]

Splunk doesn't store the file properties like Last Modified date in Splunk when monitoring the file. If you just want the unique list of sources from all hosts, try something like this

host="*" source="/log/* | stats count by source | table source

OR bette/faster

| metadata type=sources index=* OR index=_* | search source="/log/*" | table source