Splunk Search

SPL to return list of field values for a particular time

jabezds
Path Finder

Hi All,

I need a spl which will return the list of filenames that came for the latest time .

| eval latest_time = max(strftime(_time,"%Y-%m-%d")) | stats count by latest_time,filename

But im not able to achieve that through the above spl.

eg

Latest_time             filename

2020-07-28             filename1.txt

                                      filename2.txt

                                      filename3.txt

                                      filename4.txt

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

From your description it looks like you want a list of filenames that were on the most recent day for where there are files, so 

| bin _time span=1d
| stats values(filename) as filename by _time
| tail 1

If you want individual rows for each filename, then just add

| mvexpand filename

at the end 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

From your description it looks like you want a list of filenames that were on the most recent day for where there are files, so 

| bin _time span=1d
| stats values(filename) as filename by _time
| tail 1

If you want individual rows for each filename, then just add

| mvexpand filename

at the end 

Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...