Splunk Search

Show last update from indexed csv file

jugarugabi
Path Finder

Hi, 

I have a csv file that is updated by a script once a minute. 
The output is similar to: 

time,queuename,vpn,last-message-id-spooled,max-message-size-exceeded,total-messages-spooled,num-messages-spooled,current-spool-usage-in-mb,bind-count,recordsinperiod,eol
2021-05-20_10-20,q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol
2021-05-20_10-20,q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol
2021-05-20_10-19,q.static.prp.solacequeue, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol
2021-05-20_10-19,q.static.prp.solacequeue-number2, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol

Now, I want to create a search query that will show only the last update in the csv file and show me the result like this: 

q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol
q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol

Tried using the search below, but the output still shows everything that happened during the day, instead those only 2 lines. 

index=* sourcetype=queues 
| stats latest(time) by time queuename last_message_id_spooled current_spool_usage_in_mb bind_count recordsinperiod

  What am I missing?

Thanks,
Gabriel

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Will this work for you?

index=* sourcetype=queues 
| stats latest(*) as * by queuename

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Will this work for you?

index=* sourcetype=queues 
| stats latest(*) as * by queuename
0 Karma

jugarugabi
Path Finder

Thanks - that simple...

One more question: the line with the header is added as well to the results.
How can I remove that particular line and provide me only the information without the header that can be found in the csv file?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

if you are using inputlookup to read the csv file you can use the start=1 argument. If you already have ingested it into an index, you could use | where time!="time"

0 Karma

jugarugabi
Path Finder

Yup, that did the trick. 

Thanks mate!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...