Dashboards & Visualizations

Find the modified time from splunk events

krt18
New Member

Hi Team,

 I have 10 events - start event time is at 10AM ,next event time  at 10.08AM ,10.15AM,10.18AM and so on.. End event time is 10.56AM and I am able to find the start event time and end event time using min(_time) and max(_time) but I need to find the first modified time  i.e the event that occurred at 10.08AM. Please assist

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use eventstats to find start time (min(_time)), then eval after_start, if _time > start time, then get the minimum after start time.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...