Specify using the logs with the last timestamp

[rbw78]

Hello,

Is there a solution to specify in my search to get only the logs with the last timestamp ?

In fact, i have some logs created from a single file, the file is generated frequently and i only want to see the result of the last input into splunk.
I set a unique timestamp on all the logs coming from my file.
Of course i can speficy a time range but i can't be sure to have only the last whole result if i do that.

I didn't see any function in the manual which can do that.

Does there's a way of doing this ?

[MarioM]

there is an internal field _indextime which you will need to make visible using eval then sort it by the latest,for example like this:

<your search> | eval indextime=_indextime | convert ctime(indextime) | sort - indextime

[rbw78]

Yes this is what i mean, the last events indexed.
Sorry my english isn't perfect 🙂

[rbw78]

any advice ? 🙂

[MarioM]

as i said above by default the flashtimeline it's always the last event first displayed...then do you mean last event received/indexed ?

[rbw78]

My aim is to display only the lastest events and the realtime won't be ok because it used a time range.
The timestamp is just a set of numbers that increase with time

[MarioM]

i am not sure what you mean because by default on the flashtimeline it's always the last event first displayed and if you choose realtime it will be last event too but in real-time

[rbw78]

It would be like "Always display the logs with the higher timestamp"

[rbw78]

The amont of logs contained in my file is never the same, so i can't use this function.
The best way would be to use the timestamp which is the same for the logs stored in a common file.

[MarioM]

what about '| head 1' ?