topic Re: What is the difference between min() max() and earliest() latest() for _time manipulations? in Splunk Search

What is the difference between min() max() and earliest() latest() for _time manipulations?

edefIo1937 — Fri, 07 Oct 2022 17:21:38 GMT

If i only want to use the field "_time" of a log to get first and latest occurrence of an event, which commands should i use and why ?

ex:
...
| stats earliest(_time) as firsttime latest(_time) as lasttime

...

or
...

| stats min(_time) as firsttime max(_time) as lasttime

...

Is there a case where i could get differents results ?

Re: What is the difference between min() max() and earliest() latest() for _time manipulations?

gcusello — Fri, 07 Oct 2022 17:28:54 GMT

Hi @edefIo1937,

_time is a timestamp in epochtime format, in other words a progressive number, so it's the same thing.

I usually use earliest and latest.

Ciao.

Giuseppe

Re: What is the difference between min() max() and earliest() latest() for _time manipulations?

yuanliu — Fri, 07 Oct 2022 19:30:31 GMT

Whereas there is no numeric difference, I am also curious as to which one is faster. I usually go with min/max with the following reasoning:

min/max are purely mathematical after all values become available.
earliest(_time)/latest(_time), on the other hand, require two operations, one to compare time stamps on events, one to return value of _time.

The second argument, of course, is flawed. It should depend on implementation of index and search. Any Splunk insider to shed light on this?

Re: What is the difference between min() max() and earliest() latest() for _time manipulations?

jordan_art — Tue, 11 Oct 2022 07:26:43 GMT

what does Splunk recommend ?

Re: What is the difference between min() max() and earliest() latest() for _time manipulations?

gcusello — Tue, 11 Oct 2022 07:28:17 GMT

Hi @jordan_art,

there isn't a best practice, you can use both of them with the same results.

Ciao.

Giuseppe