Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Specify using the logs with the last timestamp
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Specify using the logs with the last timestamp
Hello,
Is there a solution to specify in my search to get only the logs with the last timestamp ?
In fact, i have some logs created from a single file, the file is generated frequently and i only want to see the result of the last input into splunk.
I set a unique timestamp on all the logs coming from my file.
Of course i can speficy a time range but i can't be sure to have only the last whole result if i do that.
I didn't see any function in the manual which can do that.
Does there's a way of doing this ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
there is an internal field _indextime which you will need to make visible using eval then sort it by the latest,for example like this:
<your search> | eval indextime=_indextime | convert ctime(indextime) | sort - indextime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes this is what i mean, the last events indexed.
Sorry my english isn't perfect 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
any advice ? 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
as i said above by default the flashtimeline it's always the last event first displayed...then do you mean last event received/indexed ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My aim is to display only the lastest events and the realtime won't be ok because it used a time range.
The timestamp is just a set of numbers that increase with time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i am not sure what you mean because by default on the flashtimeline it's always the last event first displayed and if you choose realtime it will be last event too but in real-time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It would be like "Always display the logs with the higher timestamp"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The amont of logs contained in my file is never the same, so i can't use this function.
The best way would be to use the timestamp which is the same for the logs stored in a common file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what about '| head 1' ?
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...
Reduce and Transform Your Firewall Data with Splunk Data Management
