https://community.splunk.com/t5/Splunk-Search/What-is-the-best-was-to-identify-the-outage-window-in-one-search/m-p/601610#M209373 <P>is there a best practice search to find the last event sent at the start of an outage and the first event the come in after the outage for a specific data source was rectified? Basically what is the best was to identify the outage window in one search?</P> Mon, 13 Jun 2022 20:57:35 GMT dolj 2022-06-13T20:57:35Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-was-to-identify-the-outage-window-in-one-search/m-p/601610#M209373 <P>is there a best practice search to find the last event sent at the start of an outage and the first event the come in after the outage for a specific data source was rectified? Basically what is the best was to identify the outage window in one search?</P> Mon, 13 Jun 2022 20:57:35 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-was-to-identify-the-outage-window-in-one-search/m-p/601610#M209373 dolj 2022-06-13T20:57:35Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-was-to-identify-the-outage-window-in-one-search/m-p/601651#M209391 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/61094">@dolj</a>,</P><P>if you want to find the time borders of a search you can use "addinfo" (<A href="https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Addinfo" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Addinfo</A>).</P><P>If instead you want to display the first and the last event, you can use stats and the options "first" and "last", something like this:</P><LI-CODE lang="markup">your_search | stats first(_raw) AS first last(_raw) AS last </LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 14 Jun 2022 06:28:38 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-was-to-identify-the-outage-window-in-one-search/m-p/601651#M209391 gcusello 2022-06-14T06:28:38Z