https://community.splunk.com/t5/Splunk-Search/First-Everyday/m-p/478746#M134231 <PRE><CODE>| eval mytime=strftime(_time, "%Y%m%d") | where x=100| dedup mytime |sort _time | head 50 </CODE></PRE> Tue, 10 Sep 2019 14:10:57 GMT reverse 2019-09-10T14:10:57Z https://community.splunk.com/t5/Splunk-Search/First-Everyday/m-p/478744#M134229 <P>There are multiple CSVs which I generate on a daily basis.<BR /> Each CSV has some critical data &amp; has 2 columns - _time &amp; XX <BR /> I JOIN all CSVs to generate graphs.<BR /> The common column in each CSV is _time.</P> <P>Now lets say I have 2 CSVs.</P> <PRE><CODE>1 _time &amp; XX 2 _time &amp; YY </CODE></PRE> <P>I need to find earlier time and corresponding XX when yy=100 (first apperance)on a daily basis.. as CSVs are there since last 2 months with all the required data.</P> <P>How can i achieve that ?</P> Tue, 10 Sep 2019 06:28:20 GMT https://community.splunk.com/t5/Splunk-Search/First-Everyday/m-p/478744#M134229 reverse 2019-09-10T06:28:20Z https://community.splunk.com/t5/Splunk-Search/First-Everyday/m-p/478745#M134230 <PRE><CODE>| stats first(_time) by x | where x=100 </CODE></PRE> <P>Not working </P> Tue, 10 Sep 2019 13:49:01 GMT https://community.splunk.com/t5/Splunk-Search/First-Everyday/m-p/478745#M134230 reverse 2019-09-10T13:49:01Z https://community.splunk.com/t5/Splunk-Search/First-Everyday/m-p/478746#M134231 <PRE><CODE>| eval mytime=strftime(_time, "%Y%m%d") | where x=100| dedup mytime |sort _time | head 50 </CODE></PRE> Tue, 10 Sep 2019 14:10:57 GMT https://community.splunk.com/t5/Splunk-Search/First-Everyday/m-p/478746#M134231 reverse 2019-09-10T14:10:57Z