https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283525#M85680 <P>when I do the search "dex=allevents sourcetype=somelogs | stats earliest(_time) as firstevent by user" i get all the users with a field 'firstevent' wich is a string of numbers and I can't quite make out what this means. </P> Tue, 26 Jul 2016 17:20:51 GMT pladamsplunk 2016-07-26T17:20:51Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283523#M85678 <P>I'm trying to create a report which will find the number of 'new users'. I've extracted the field <STRONG>user</STRONG>. I want to find the earliest event generated for every given user within the user field, and then create the restriction to only show the number of users whose first events were created within some recent time. This number will be the number of new users. Can anyone help me create a search to accomplish this goal?</P> Tue, 26 Jul 2016 17:12:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283523#M85678 pladamsplunk 2016-07-26T17:12:36Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283524#M85679 <P>Try this</P> <PRE><CODE>index=allevents sourcetype=somelogs | stats earliest(_time) as firstevent by user | where _time&gt;some_recent_time </CODE></PRE> Tue, 26 Jul 2016 17:15:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283524#M85679 sundareshr 2016-07-26T17:15:10Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283525#M85680 <P>when I do the search "dex=allevents sourcetype=somelogs | stats earliest(_time) as firstevent by user" i get all the users with a field 'firstevent' wich is a string of numbers and I can't quite make out what this means. </P> Tue, 26 Jul 2016 17:20:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283525#M85680 pladamsplunk 2016-07-26T17:20:51Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283526#M85681 <P>The string of numbers is epoch time, You can format the time like this. I would recommend you leave it as epoch to do the time compare and then change to readable format. (.... depicts your current search)</P> <PRE><CODE>.... | eval firstevent=strftime(firstevent, "%c") </CODE></PRE> <P>To filter based on time, you could try something like this</P> <PRE><CODE>.... | where firstevent&gt;relative_time(now(), "-1mon") | eval firstevent=strftime(firstevent, "%x %X") </CODE></PRE> Tue, 26 Jul 2016 17:27:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283526#M85681 sundareshr 2016-07-26T17:27:17Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283527#M85682 <P>.... | where firstevent&gt;relative_time(now(), "-1mon") | eval firstevent=strftime(firstevent, "%x %X")</P> <P>This command will compare the current date stored in splunk against the -1mon (or whatever is here) correct?</P> Tue, 26 Jul 2016 17:32:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283527#M85682 pladamsplunk 2016-07-26T17:32:15Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283528#M85683 <P>That's Correct</P> Tue, 26 Jul 2016 17:33:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283528#M85683 sundareshr 2016-07-26T17:33:45Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283529#M85684 <P>It all works thank you very much, up voted!</P> Tue, 26 Jul 2016 17:55:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283529#M85684 pladamsplunk 2016-07-26T17:55:27Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283530#M85685 <P>Please mark the answer as accepted to close it out.</P> Tue, 26 Jul 2016 17:56:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-earlier-events-for-a-given-field/m-p/283530#M85685 sundareshr 2016-07-26T17:56:23Z