https://community.splunk.com/t5/Splunk-Search/How-to-write-a-query-using-the-stats-earliest-and-stats-latest/m-p/308167#M161941 <P>How to place the "earliest and latest " functions ? Can anyone provide an example of such a query with the output !</P> Thu, 29 Mar 2018 21:26:38 GMT Pravinraju 2018-03-29T21:26:38Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-query-using-the-stats-earliest-and-stats-latest/m-p/308167#M161941 <P>How to place the "earliest and latest " functions ? Can anyone provide an example of such a query with the output !</P> Thu, 29 Mar 2018 21:26:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-query-using-the-stats-earliest-and-stats-latest/m-p/308167#M161941 Pravinraju 2018-03-29T21:26:38Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-query-using-the-stats-earliest-and-stats-latest/m-p/308168#M161942 <P>You can find them here:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Eventorderfunctions#earliest.28X.29">http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Eventorderfunctions#earliest.28X.29</A></P> <P>Remember, since both these functions works on chronological occurrence of events/fields, they work accurately if the field _time is available in the results (before you run the stats command).</P> Thu, 29 Mar 2018 23:51:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-query-using-the-stats-earliest-and-stats-latest/m-p/308168#M161942 somesoni2 2018-03-29T23:51:44Z