Show last update from indexed csv file

[jugarugabi]

Hi, 

I have a csv file that is updated by a script once a minute. 
The output is similar to: 

time,queuename,vpn,last-message-id-spooled,max-message-size-exceeded,total-messages-spooled,num-messages-spooled,current-spool-usage-in-mb,bind-count,recordsinperiod,eol
2021-05-20_10-20,q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol
2021-05-20_10-20,q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol
2021-05-20_10-19,q.static.prp.solacequeue, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol
2021-05-20_10-19,q.static.prp.solacequeue-number2, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol

Now, I want to create a search query that will show only the last update in the csv file and show me the result like this: 

q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol
q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol

Tried using the search below, but the output still shows everything that happened during the day, instead those only 2 lines. 

index=* sourcetype=queues 
| stats latest(time) by time queuename last_message_id_spooled current_spool_usage_in_mb bind_count recordsinperiod

  What am I missing?

Thanks,
Gabriel

[ITWhisperer · Accepted solution]

Will this work for you?

index=* sourcetype=queues 
| stats latest(*) as * by queuename

[jugarugabi]

Thanks - that simple...

One more question: the line with the header is added as well to the results.
How can I remove that particular line and provide me only the information without the header that can be found in the csv file?

[ITWhisperer]

if you are using inputlookup to read the csv file you can use the start=1 argument. If you already have ingested it into an index, you could use | where time!="time"

[jugarugabi]

Yup, that did the trick. 

Thanks mate!