Does the data getting indexed have timestamp in it? If yes they are they all same for one import? Do the data have any field/combination of field to uniquely identify each row (to differentiate between different imports).
E.g. suppose data to be imported is CustomerId|CurrentBalance. then
import 1 CUS1|100
import 2 CUS1|110
import 3 CUS1|200
If you have CustomerId as unique field for one import, your can use
your base search | stats first(*) as * by CustomerId
Splunk offers a few search commands to help fetch the most recent data. Since Splunk always searches backwards in time, the first events found will be the most recent. Look at head
, stats first(x)
, and stats latest(x)
.
hmm ok Thanks for reply
But if you can't define this yourself, you can't expect Splunk to be able to define it either...
Am not able to define that.. Thats the reason, I would like to know if any workaround to fetch latest data. without mention date time period
How would you define "latest" as opposed to not latest?
Example:
per day two/three times data get captured in splunk. I woluld like search only latest captured data .