Search latest indexed file for different sourcetype

[meenal901]

Hi,

I have 3 sources from which the files are loaded into Splunk, the time of arrival of files and frequency is different for all three.
source-1 -> every 5 minutes
source-2 -> every 1 hour
source-3 -> every 4 hours

Now, these files go into same folder based on version, which is a common field for all three, not the version. I want to search in the latest files (time based in their own family) of source-1, source-2 and source-3 irrespective of their comparative index time. I don't want to use transaction command.

Is it possible? If so, how?

Thanks,
Meenal

[kristian_kolb]

If all your sources are on NTP or similar, so that you can trust the event timestamps, something like this perhaps?

(source=source_1 AND earliest=-5m) OR (source=source_2 AND earliest=-1h) OR (source=source_3 AND earliest=-4h) | the rest of your search

/Kristian