Splunk Search

Query Logs with the latest time

mursidehsani
Explorer

I have this query


is not mapped to ink name
| rex "(?<time>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}).*Ink Type '(?<ink_type>[^']+)'"
| sort - time
| table time ink_type

that will have this result

mursidehsani_0-1730874342563.png

I want the result to be just the latest log date. In this case it will only show the top 3. And when new logs comes in, then it will show that new logs only

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @mursidehsani,

please try this:

<your_search>
| rex "(?<time>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}).*Ink Type '(?<ink_type>[^']+)'"
| stats values(ink_type) AS ink_type BY time
| sort - time
| head 1
| mvexpand ink_type

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @mursidehsani,

please try this:

<your_search>
| rex "(?<time>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}).*Ink Type '(?<ink_type>[^']+)'"
| stats values(ink_type) AS ink_type BY time
| sort - time
| head 1
| mvexpand ink_type

Ciao.

Giuseppe

mursidehsani
Explorer

Hi @gcusello 

It works! Thank you so much for your help.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mursidehsani ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...