https://community.splunk.com/t5/Splunk-Search/Search-to-display-the-first-instance-of-a-particular-field/m-p/328885#M97900 <P><CODE>... | stats earliest(_time) by src_ip</CODE></P> Sat, 27 Jan 2018 16:29:02 GMT martin_mueller 2018-01-27T16:29:02Z https://community.splunk.com/t5/Splunk-Search/Search-to-display-the-first-instance-of-a-particular-field/m-p/328884#M97899 <P>I have a search which extracts some values into a table including the date. For one of the fields, e.g. src_ip, I want to show the first date that that value (a particular ip address) was seen. All the stats functions I have tried seem to aggregate the values. Is there a way to do what i want? Thanks</P> Sat, 27 Jan 2018 04:58:30 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-display-the-first-instance-of-a-particular-field/m-p/328884#M97899 jsc7 2018-01-27T04:58:30Z https://community.splunk.com/t5/Splunk-Search/Search-to-display-the-first-instance-of-a-particular-field/m-p/328885#M97900 <P><CODE>... | stats earliest(_time) by src_ip</CODE></P> Sat, 27 Jan 2018 16:29:02 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-display-the-first-instance-of-a-particular-field/m-p/328885#M97900 martin_mueller 2018-01-27T16:29:02Z