Summary row listing minimum value

[adent]

I am trying to get individual values and add a summary row with the minimum value. In this case I have 3 times and want the output to have all three times and create a minimum time row (labelname=min).

event    _time

a          10:00

b           11:00
c            10:30

min    10:00

[ITWhisperer]

| appendpipe
  [| stats min(_time) as _time
  | eval event="min"]

[gcusello]

Hi @adent,

Only one question, if you have events in more days, an event at previous day 23.59 is earlier than an event at second day 1.30, but calculatig min on the time value it's different.

Do you want to calculate min only on time or the earliest timestamp? 

If min on time, you should run something like this:

<your_search>
| eval Time=strftime(_time,"%H.%M")
| stats min(Time) AS Time BY event
| append [ search <your_search> | eval Time=strftime(_time,"%H.%M") | stats min(Time) AS Time
| eval Time=strftime(Time,"%H.%M")

if the earliest timestamp, you could try something like this:

<your_search>
| stats earliest(_time) AS Time BY event
| append [ search <your_search> | stats earlieste() AS _time
| eval _time=strftime(_time,"%Y-%m-%d %H.%M")

I could be more detailed if you share a sample of your logs and (if you already have) a search that you're using?

Ciao.

Giuseppe