topic Re: How to find earliest event based on Event code for once server? in Splunk Search

How to find earliest event based on Event code for once server?

singhg — Thu, 26 Apr 2012 16:39:03 GMT

Hi,

I am trging to find the first time the event ID 4656 was indexed for particular server.

the below search gives me only the first time any event was indexed for this server:
| metadata index=main type=hosts | search host="Name" | fields + host, firstTime | convert ctime(firstTime)

Do you know a command to do that?

Re: How to find earliest event based on Event code for once server?

cphair — Thu, 26 Apr 2012 17:27:34 GMT

For a known host foo:

index=main EventCode=4656 host=foo | stats earliest(_time) as Earliest | eval FirstSeen=strftime(Earliest,"%+") | table FirstSeen

To find the first time the event occurred on each host in the index:

index=main EventCode=4656 | stats earliest(_time) as Earliest by host | eval FirstSeen=strftime(Earliest,"%+") | table host,FirstSeen

Re: How to find earliest event based on Event code for once server?

singhg — Fri, 27 Apr 2012 02:05:27 GMT

Thanks cphair for your reply but when I run this i get this error:

Error in 'stats' command: The argument 'earliest(_time)' is invalid.

Re: How to find earliest event based on Event code for once server?

cphair — Mon, 28 Sep 2020 11:44:45 GMT

@singhg, are you on an earlier version of Splunk? It looks like the earliest function was introduced in 4.3. You can try last(_time) instead of earliest(_time), which looks at the time the event was indexed rather than the actual timestamp and so may be a bit less accurate.