Splunk Search

Is it possible to search the modified date/time of a file?

Engager

Is it possible to get the modified date/time of a file in search? The search below shows the time based on events and because of that, I have multiple entries of the same file. Will it be possible to generate a unique list?

host="*" source="/log/*" | table by source, _time

Thanks!

Tags (3)
0 Karma
1 Solution

Engager

Thanks a ton for your time and help. Found out the transaction seem to suit the requirement. Thanks Again. ciao

View solution in original post

0 Karma

Engager

Thanks a ton for your time and help. Found out the transaction seem to suit the requirement. Thanks Again. ciao

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

OR even better/faster:

| tstats latest(_time) as _time where index=* by source

Also includes that unique last-modified timestamp per source @rmsagar asked for 🙂

SplunkTrust
SplunkTrust

Splunk doesn't store the file properties like Last Modified date in Splunk when monitoring the file. If you just want the unique list of sources from all hosts, try something like this

host="*" source="/log/* | stats count by source | table source

OR bette/faster

| metadata type=sources index=* OR index=_* | search source="/log/*" | table source
0 Karma