topic Re: why stats last and first are inverted ? in Splunk Search

why stats last and first are inverted ?

mataharry — Tue, 13 Mar 2012 01:35:13 GMT

When I search with stats first(myfield) last(myfield)
They return the opposite !!!!

example :
10/10/2010 myfield=A
12/12/2012 myfield=B

| stats first(myfield) last(myfield) returns first=B, last=A

Re: why stats last and first are inverted ?

yannK — Tue, 13 Mar 2012 01:36:58 GMT

Splunk starts to search events at the current time, and progressively search backward in the past.

first() returns the first seen result -> the most recent reference
last() returns the last seen result - > the oldest reference

Please read the documentation with attention :
http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/CommonStatsFunctions

Re: why stats last and first are inverted ?

mataharry — Tue, 13 Mar 2012 01:37:37 GMT

This is so crazy, why using so confusing names !

Re: why stats last and first are inverted ?

willthames2 — Tue, 13 Mar 2012 01:57:52 GMT

Note that

earliest
latest

also exist which have the meanings that you seem to be looking for from first and last.

Re: why stats last and first are inverted ?

araitz — Tue, 13 Mar 2012 04:46:59 GMT

Splunk is a reverse time-series index, so while it might be confusing, it is techically correct. The results of a Splunk search are ordered by default from most recent to least recent.

Re: why stats last and first are inverted ?

HeinzWaescher — Fri, 01 Nov 2013 17:15:55 GMT

Hi,

does it make a difference, how the events are sorted? So, is "last seen" independent of the order of the events and does always mean "the earliest timestamp"?

Thanks in advance

Heinz

Re: why stats last and first are inverted ?

lguinn2 — Mon, 04 Nov 2013 18:19:49 GMT

Yes it matters how events are sorted for the first and last functions. However, the sort order does not matter for the earliest and latest functions, as they are based on the event timestamp.

Re: why stats last and first are inverted ?

yannK — Tue, 18 Feb 2014 22:01:51 GMT

see http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/CommonStatsFunctions

Re: why stats last and first are inverted ?

jperezes — Tue, 05 Apr 2016 13:23:26 GMT

Hi, I have then a situation that is confusing me.
I use last to store the first occurrence of an event, then I store that in a lookup file.
Next thing I do is to do a sub search for the last 24h get the first occurrence and append that to the lookup file.
at that point I need to remove duplicates and keep only the very last in the lookup file.

Does that convention also works when you are not looking up at the stored data events but in a lookup file???

Thanks in advance,

Rgds,
Juan