I'm constantly feeding my splunk with a .csv source, all of them with a pattern ïn their name: "Data1.csv", "Data2.csv", "Data3.csv", etc...
These csv's have a table like:
_time | Extracted_Host | Info1 | Info2 | Info3
How could I search only for the distinct count of Extracted_host, but only counting based on the latest submitted events? For example: if the latest csv is called Data5.csv, I want my search to get the distinct count of extracted_Host in the Data5.csv, if is Data6.csv, I want my search to get the distinct count of extracted_Host in Data6.csv
↧