Dashboards & Visualizations

Extracting the first and last entry of a ticket

htvuthi
New Member

Hi, I am currently working on a ticket reporting. 
Each ticket has a lastUpdateDate field which gets updates multiple times leading to duplicates. I only need the first lastUpdateDate and latest lastUpdateDate to determine when the ticket has entered the pipe and the latest to see if changes were made in the specific period range of the reporting.

I tried using | stats first(_raw) as first_entry last(_raw) as last_entry by ticket_id but it shows me the same lastUpdateDate for both.

I have read to use min and max but do not gain results from that either. 

Thanks in advance for any hints and tips!

Labels (1)
0 Karma

PaulPanther
Motivator

You have to use latest and earliest to get the oldest and most recent event.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...