topic How do I return the time of the first event from a specific host in the main index? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-return-the-time-of-the-first-event-from-a-specific-host/m-p/67167#M16784 <P>Need to determine the date and time of when a specific host first logged to Splunk ...</P> Fri, 08 Oct 2010 23:41:25 GMT MikeyG 2010-10-08T23:41:25Z How do I return the time of the first event from a specific host in the main index? https://community.splunk.com/t5/Splunk-Search/How-do-I-return-the-time-of-the-first-event-from-a-specific-host/m-p/67167#M16784 <P>Need to determine the date and time of when a specific host first logged to Splunk ...</P> Fri, 08 Oct 2010 23:41:25 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-return-the-time-of-the-first-event-from-a-specific-host/m-p/67167#M16784 MikeyG 2010-10-08T23:41:25Z Re: How do I return the time of the first event from a specific host in the main index? https://community.splunk.com/t5/Splunk-Search/How-do-I-return-the-time-of-the-first-event-from-a-specific-host/m-p/67168#M16785 <P>If you're looking for the date/time of the event (ie. what the value Splunk has extracted from the Event), use this search:</P> <P>single host:</P> <PRE><CODE>| metadata type=hosts index=main | search host=&lt;YOUR HOST&gt; | convert ctime(firstTime) | table host firstTime </CODE></PRE> <P>all hosts:</P> <PRE><CODE>| metadata type=hosts index=main | convert ctime(firstTime) | table host firstTime </CODE></PRE> <P>If you're looking for when the first event has been indexed use this search: (Select All time in the time range picker - may take a while)</P> <P>single host:</P> <PRE><CODE>index=main host=&lt;YOUR HOST&gt; | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime </CODE></PRE> <P>all hosts:</P> <PRE><CODE>index=main | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime </CODE></PRE> Fri, 08 Oct 2010 23:49:34 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-return-the-time-of-the-first-event-from-a-specific-host/m-p/67168#M16785 ziegfried 2010-10-08T23:49:34Z Re: How do I return the time of the first event from a specific host in the main index? https://community.splunk.com/t5/Splunk-Search/How-do-I-return-the-time-of-the-first-event-from-a-specific-host/m-p/67169#M16786 <P>That time/date would be outside the data that's currently in the main index ...</P> Sat, 09 Oct 2010 00:10:25 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-return-the-time-of-the-first-event-from-a-specific-host/m-p/67169#M16786 MikeyG 2010-10-09T00:10:25Z