https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493934#M137715 <P>The problem with <CODE>stats</CODE> as it's used here is it discards all fields except those it uses. In this case, it means only the FirstEvent field is available to later commands. To get the other fields from the events, you must include them in the <CODE>stats</CODE> command.</P> <PRE><CODE>| stats earliest(_time) as FirstEvent. values(*) as * | addinfo | eval duration=(FirstEvent - info_min_time) </CODE></PRE> Tue, 12 May 2020 15:09:12 GMT richgalloway 2020-05-12T15:09:12Z https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493933#M137714 <P>Hi all, </P> <P>I am still a Splunk novice but I am looking for some help using the earliest command. I am calculating a duration from the beginning of my search period to the first event in the search period. For example, lets say the time frame is from 08:00 - 09:00 and the first event is seen at 08:15. This is my code :</P> <PRE><CODE>| stats earliest(_time) as FirstEvent | addinfo | eval duration=(FirstEvent - info_min_time) </CODE></PRE> <P>So I am, able to get the timestamp of the earliest event at 08:15 BUT I would also like to get the fields associated with that earliest event. I have tried using two earliest commands but one overrides the other. In short, how do I get the fields associated with the (earliest) 08:15 event? </P> Tue, 12 May 2020 14:19:53 GMT https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493933#M137714 aaloisi 2020-05-12T14:19:53Z https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493934#M137715 <P>The problem with <CODE>stats</CODE> as it's used here is it discards all fields except those it uses. In this case, it means only the FirstEvent field is available to later commands. To get the other fields from the events, you must include them in the <CODE>stats</CODE> command.</P> <PRE><CODE>| stats earliest(_time) as FirstEvent. values(*) as * | addinfo | eval duration=(FirstEvent - info_min_time) </CODE></PRE> Tue, 12 May 2020 15:09:12 GMT https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493934#M137715 richgalloway 2020-05-12T15:09:12Z https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493935#M137716 <P>So adding the "values" to the stats gets really close to what I need but not exactly. Values returns a list of the distinct values of field X. In my case there are 2 distinct values. I want the current value of field X at time=earliest (08:15).</P> Tue, 12 May 2020 18:02:32 GMT https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493935#M137716 aaloisi 2020-05-12T18:02:32Z https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493936#M137717 <P>Try <CODE>earliest</CODE> instead of <CODE>values</CODE>.</P> Tue, 12 May 2020 18:57:44 GMT https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493936#M137717 richgalloway 2020-05-12T18:57:44Z https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493937#M137718 <P>Thanks @richgalloway this is exactly what I needed! </P> Thu, 14 May 2020 12:48:38 GMT https://community.splunk.com/t5/Splunk-Search/Get-fields-associated-with-the-earliest-event-in-a-search/m-p/493937#M137718 aaloisi 2020-05-14T12:48:38Z