https://community.splunk.com/t5/Splunk-Search/how-to-get-the-first-raw-when-i-have-split-my-pattern-which-were/m-p/248150#M189185 <P>See if this helps</P> <PRE><CODE>... | makemv unique_exception delim="|" | mvexpand unique_exception | stats first(_raw) as first_occurrence by unique_exception </CODE></PRE> Fri, 26 Aug 2016 13:59:41 GMT sundareshr 2016-08-26T13:59:41Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-first-raw-when-i-have-split-my-pattern-which-were/m-p/248148#M189183 <P><STRONG>unique_exception= pattern1|pattern2|pattern3</STRONG><BR /> all these three patterns(1,2,3) are tagged to unique number 111.<BR /> <STRONG>eval temp=split(unique_exception, "|")|stats values(temp) by temp</STRONG><BR /> i am getting output as follows<BR /> <STRONG>111 - pattern1</STRONG><BR /> <STRONG>111 - pattern2</STRONG><BR /> <STRONG>111 - pattern3</STRONG></P> <P>now how to get the first event for these individual events (pattern1 and pattern2 and pattern3) separately.</P> Fri, 26 Aug 2016 13:40:14 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-first-raw-when-i-have-split-my-pattern-which-were/m-p/248148#M189183 annamareddi 2016-08-26T13:40:14Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-first-raw-when-i-have-split-my-pattern-which-were/m-p/248149#M189184 <P>Please check this </P> <PRE><CODE>eval temp=split(unique_exception, "|")|stats first(_time) as _time values(temp) by temp </CODE></PRE> <P>There is a good reference for Functions for stats in the docs. - <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commonstatsfunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commonstatsfunctions</A></P> Fri, 26 Aug 2016 13:51:22 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-first-raw-when-i-have-split-my-pattern-which-were/m-p/248149#M189184 inventsekar 2016-08-26T13:51:22Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-first-raw-when-i-have-split-my-pattern-which-were/m-p/248150#M189185 <P>See if this helps</P> <PRE><CODE>... | makemv unique_exception delim="|" | mvexpand unique_exception | stats first(_raw) as first_occurrence by unique_exception </CODE></PRE> Fri, 26 Aug 2016 13:59:41 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-first-raw-when-i-have-split-my-pattern-which-were/m-p/248150#M189185 sundareshr 2016-08-26T13:59:41Z