index=XXX  host=XXX  sourcetype=XXX source=<sourcefilepath>/InformationtoSplunk*  | dedup _raw | fields source A B C D | eval Time=source | replace <sourcefilepath>/InformationtoSplunk* .csv WITH * in Time | search Time!="*_*" | eval Time_tmp=strftime(strptime(Time,"%Y%m%d"),"%Y%m") | eval cur=strftime(now(),"%Y%m") | where Time_tmp=cur | eval Time=strptime(Time,"%Y%m%d")+1 | eval _time=Time | eval jobs=B+C+D | dedup jobs | timechart span=1d count(jobs) | eval Threshold=20000 ... View more

the query displays the total count for all the runs example:  1Aug - 07am (count = 14000),   08 am (count=15000), ... Next day 06:00 am(18000)  2 Aug - 07am (count = 11000),   08 am (count=12500), ... Next day 06:00 am(19500)   ... so on until 30th Aug  - 07am (count = 2000),   08 am (count=10000), ... Next day 06:00 am(12500)   My requirement is to only get the last count of the day i.e 1 Aug (18000) , 2 Aug (19500) ... 30th Aug (12500)                ... View more

I am looking for the total number of record for the last log file created. Example: 07:00 am - log_20210801.csv    --count = 14000 08:00 am - log_20210801.csv    -- count = 14500 (file will overwrite) and so on.. until  next day  06:00am -log_20210801.csv      -- count = 17000 (file will overwrite and contain the final update events for                                                                                                         the day) 07:00am -log_20210802.csv      -- count 16000 until 06:00am  -log_20210802.csv     -- count 20000 (file will overwrite)        here number of records in last log files are 17000 and 20000 need this value only and using the logic will perform search for last 30 days to create a bar diagram to visually display the trend   ... View more