https://community.splunk.com/t5/Splunk-Search/What-is-the-most-efficient-approach-to-identify-the-earliest/m-p/131556#M35902 <P><CODE>map</CODE> rarely is the most efficient approach. Consider something like this:</P> <PRE><CODE>index=msexchange [search that produces the user ids or email addresses of the users you want to investigate | fields user] | stats earliest(_time) as _time by user </CODE></PRE> <P>That will only go through the events for the users you're interested in, going through every bucket once. With <CODE>map</CODE> you will inevitably go through all the data once per user, making that much less efficient.</P> Tue, 25 Nov 2014 19:45:01 GMT martin_mueller 2014-11-25T19:45:01Z https://community.splunk.com/t5/Splunk-Search/What-is-the-most-efficient-approach-to-identify-the-earliest/m-p/131555#M35901 <P>I am looking to identify the earliest event for each field-value pair. For example, given a list of usernames from AD, I want to locate the very first email they sent without having to search all emails from all users throughout all time. My thinking is perhaps to do a search on AD for the username, email, and account creation date (whenCreated), and then feed the emails and whenCreated into a map function onto a search of index=msexchange .. Like the following:</P> <PRE><CODE>... my AD search for username, email and whenCreated | eval time_b4=relative_time(time_anchor, "-1h") | eval time_l8r=relative_time(time_anchor, "+1h") | map search="search index=index1 sourcetype=sourcetype1 field1=$field$ earliest=$time_b4$ latest=$time_l8r$" </CODE></PRE> <P>Is this the most efficient approach? Will map join events found to the original events populating the $field$ and $time_b4$/$time_l8r$? Or will it simply add events to the results? Or will it filter the existing events based on the events found?</P> Mon, 28 Sep 2020 18:14:39 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-most-efficient-approach-to-identify-the-earliest/m-p/131555#M35901 landen99 2020-09-28T18:14:39Z https://community.splunk.com/t5/Splunk-Search/What-is-the-most-efficient-approach-to-identify-the-earliest/m-p/131556#M35902 <P><CODE>map</CODE> rarely is the most efficient approach. Consider something like this:</P> <PRE><CODE>index=msexchange [search that produces the user ids or email addresses of the users you want to investigate | fields user] | stats earliest(_time) as _time by user </CODE></PRE> <P>That will only go through the events for the users you're interested in, going through every bucket once. With <CODE>map</CODE> you will inevitably go through all the data once per user, making that much less efficient.</P> Tue, 25 Nov 2014 19:45:01 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-most-efficient-approach-to-identify-the-earliest/m-p/131556#M35902 martin_mueller 2014-11-25T19:45:01Z