this is not working when i am using it with multi index....
(index=abc sourcetype=SUMMARY_CDR_VW Server=CLGRAB1201T ) OR
[ metasearch index=csvlookups source="F:\SplunkMonitor\csvlookups\Core_Network*.csv" earliest=@mon latest=now()
| stats latest(source) as source],
any other way we can achieve this
... View more
this is not working when i am using it with multi index....
(index=abc sourcetype=SUMMARY_CDR_VW Server=CLGRAB1201T ) OR
[ metasearch index=csvlookups source="F:\SplunkMonitor\csvlookups\Core_Network\*.csv" earliest=@mon latest=now()
| stats latest(source) as source],
any other way we can achieve this
... View more
HI to this i have one query, for 2nd index i want to select the latest source file , how can we achieve that..
i used |stats latest(source) as source but getting error while running the script
... View more