Search in the earliest source

ryastrebov — Fri, 19 Apr 2013 09:02:49 GMT

Hello!
I have sourtsetype that contains multiple source. Into sourcetype permanently add new source. I need to search in the earliest source. For extract most earliest source I use this search request:

This search successfully return of earliest source name. How I can make search into this source? This search request is not working:

sourcetype="MySourceType" source=* NOT [ | inputlookup usedfiles.csv|fields source]| stats dc(source) by source | sort 1 by source | fields - dc(source) | outputlookup append=true usedfiles.csv | search Field="value"

Re: Search in the earliest source

jstockamp — Fri, 19 Apr 2013 14:08:40 GMT

I would think you could just use the "earliest" function of stats - i.e.

sourcetype="mysourcetype" | stats earliest(source) as firstsource | search source=firstsource

Re: Search in the earliest source

ryastrebov — Fri, 19 Apr 2013 14:35:57 GMT

Thank you!
And as the search will proceed to the next source?

topic Re: Search in the earliest source in Getting Data In

Search in the earliest source

Re: Search in the earliest source

Re: Search in the earliest source