Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to get distinct count of a field only for the latest events?

$
0
0
I'm constantly feeding my splunk with a .csv source, all of them with a pattern ïn their name: "Data1.csv", "Data2.csv", "Data3.csv", etc... These csv's have a table like: _time | Extracted_Host | Info1 | Info2 | Info3 How could I search only for the distinct count of Extracted_host, but only counting based on the latest submitted events? For example: if the latest csv is called Data5.csv, I want my search to get the distinct count of extracted_Host in the Data5.csv, if is Data6.csv, I want my search to get the distinct count of extracted_Host in Data6.csv

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>