topic Re: Display Minimum and Maximum values in a Column in Dashboards & Visualizations

Display Minimum and Maximum values in a Column

NeonFlash — Mon, 28 Sep 2020 13:04:40 GMT

I am querying a sourcetype which has a field called _time that displays the timestamp of the event. The format of this field is: 1/9/13 10:10:53.000 AM

Now, I want to display the minimum and maximum timestamps in the entire column.

I tried using the min and max functions however it does not give any output.

table min(_time), max(_time)

This way I would get the first instance and the last instance of the event from the logs.

I even tried to use the eval function as follows:

table eval(min(_time)), eval(max(_time))

Re: Display Minimum and Maximum values in a Column

sdaniels — Thu, 10 Jan 2013 03:31:03 GMT

I think you may be looking for the commands head and tail.

| head 1 will give you the latest event and tail will give you the earliest for your specified time range.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/head
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Tail

Re: Display Minimum and Maximum values in a Column

yannK — Thu, 10 Jan 2013 03:49:33 GMT

use stats, not table.

Re: Display Minimum and Maximum values in a Column

Suda — Thu, 10 Jan 2013 06:37:43 GMT

I recommend you to use the following search commans after your searches.

(your search) 
| stats max(_time) AS max min(_time) AS min 
| eval max=strftime(max, "%Y/%m/%d %T.%3Q") 
| eval min=strftime(min, "%Y/%m/%d %T.%3Q")
| table min max

Thanks.