Is there a solution to specify in my search to get only the logs with the last timestamp ?
In fact, i have some logs created from a single file, the file is generated frequently and i only want to see the result of the last input into splunk.
I set a unique timestamp on all the logs coming from my file.
Of course i can speficy a time range but i can't be sure to have only the last whole result if i do that.
I didn't see any function in the manual which can do that.
Does there's a way of doing this ?
The amont of logs contained in my file is never the same, so i can't use this function.
The best way would be to use the timestamp which is the same for the logs stored in a common file.
i am not sure what you mean because by default on the flashtimeline it's always the last event first displayed and if you choose realtime it will be last event too but in real-time
My aim is to display only the lastest events and the realtime won't be ok because it used a time range.
The timestamp is just a set of numbers that increase with time
there is an internal field _indextime which you will need to make visible using eval then sort it by the latest,for example like this:
<your search> | eval indextime=_indextime | convert ctime(indextime) | sort - indextime