Hi,
I have a csv file that is updated by a script once a minute.
The output is similar to:
time,queuename,vpn,last-message-id-spooled,max-message-size-exceeded,total-messages-spooled,num-messages-spooled,current-spool-usage-in-mb,bind-count,recordsinperiod,eol
2021-05-20_10-20,q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol
2021-05-20_10-20,q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol
2021-05-20_10-19,q.static.prp.solacequeue, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol
2021-05-20_10-19,q.static.prp.solacequeue-number2, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol
Now, I want to create a search query that will show only the last update in the csv file and show me the result like this:
q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol
q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol
Tried using the search below, but the output still shows everything that happened during the day, instead those only 2 lines.
index=* sourcetype=queues
| stats latest(time) by time queuename last_message_id_spooled current_spool_usage_in_mb bind_count recordsinperiod
What am I missing?
Thanks,
Gabriel
Will this work for you?
index=* sourcetype=queues
| stats latest(*) as * by queuename
Will this work for you?
index=* sourcetype=queues
| stats latest(*) as * by queuename
Thanks - that simple...
One more question: the line with the header is added as well to the results.
How can I remove that particular line and provide me only the information without the header that can be found in the csv file?
if you are using inputlookup to read the csv file you can use the start=1 argument. If you already have ingested it into an index, you could use | where time!="time"
Yup, that did the trick.
Thanks mate!