Find the modified time from splunk events

[krt18]

Hi Team,

 I have 10 events - start event time is at 10AM ,next event time  at 10.08AM ,10.15AM,10.18AM and so on.. End event time is 10.56AM and I am able to find the start event time and end event time using min(_time) and max(_time) but I need to find the first modified time  i.e the event that occurred at 10.08AM. Please assist

[ITWhisperer]

Use eventstats to find start time (min(_time)), then eval after_start, if _time > start time, then get the minimum after start time.