How can I get the 10 oldest events of a search first and quickly?

daniel333 — Fri, 24 Feb 2017 17:35:07 GMT

All,

Any idea how I get the 10 oldest events from the search below? I need it to validate that we have 90 days of retention for an audit. Seems like I should be able to go a head 10. Seems to be there should be a faster way of doing this rather than just using the head/tail functions?

index=* host=*dcs* sourcetype="WinEventLog:Security"

Re: How can I get the 10 oldest events of a search first and quickly?

muebel — Fri, 24 Feb 2017 17:49:35 GMT

Hi daniel333, tstats looks like a good use here. For instance:

| tstats min(_time) as earliestTime where index=* host=*dcs* sourcetype="WinEventLog:Security" | convert ctime(earliestTime)

Run it over 90 or more days to get the minimum value for the events that match that search.

You could get a more informative look on retention by splitting by host, for instance:

    | tstats min(_time) as earliestTime where index=* host=*dcs* sourcetype="WinEventLog:Security" by host | convert ctime(earliestTime)

To get the raw events themselves, I'd just use a custom search time that has a narrow window, like earliest=-90d@d latest=-89d@d to make the search run faster

Please let me know if this answers your question! 😄

topic How can I get the 10 oldest events of a search first and quickly? in Splunk Search

How can I get the 10 oldest events of a search first and quickly?

Re: How can I get the 10 oldest events of a search first and quickly?